WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-changelog

[Xen-changelog] [xen-unstable] merge with xen-unstable.hg

To: xen-changelog@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-changelog] [xen-unstable] merge with xen-unstable.hg
From: Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>
Date: Thu, 26 Oct 2006 12:10:54 +0000
Delivery-date: Thu, 26 Oct 2006 05:15:52 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-changelog-request@lists.xensource.com?subject=help>
List-id: BK change log <xen-changelog.lists.xensource.com>
List-post: <mailto:xen-changelog@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=unsubscribe>
Reply-to: xen-devel@xxxxxxxxxxxxxxxxxxx
Sender: xen-changelog-bounces@xxxxxxxxxxxxxxxxxxx
# HG changeset patch
# User awilliam@xxxxxxxxxxx
# Node ID b725c9e51a7cebc8069c95986179a819ff6bf563
# Parent  5176c3ea32938ab37f9b60d3716de33ee3192d9e
# Parent  7da100019e00018346877608d9110f1bde8817d5
merge with xen-unstable.hg
---
 linux-2.6-xen-sparse/arch/i386/mm/ioremap-xen.c      |    8 
 linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c      |   14 
 linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c   |  142 +++--
 linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c   |   51 --
 linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c     |  136 +----
 linux-2.6-xen-sparse/drivers/xen/netback/common.h    |    2 
 linux-2.6-xen-sparse/drivers/xen/netback/interface.c |   26 -
 linux-2.6-xen-sparse/drivers/xen/netback/netback.c   |  162 +++---
 linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c    |   89 ---
 linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c |  170 ++++--
 linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c   |  170 ++++--
 linux-2.6-xen-sparse/drivers/xen/tpmback/common.h    |    8 
 linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c |   19 
 linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c   |   14 
 linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h   |    1 
 linux-2.6-xen-sparse/include/xen/balloon.h           |   20 
 linux-2.6-xen-sparse/mm/memory.c                     |    5 
 tools/blktap/drivers/Makefile                        |    3 
 tools/blktap/drivers/blktapctrl.c                    |   16 
 tools/blktap/lib/blktaplib.h                         |    4 
 tools/blktap/lib/xenbus.c                            |  191 ++++---
 tools/blktap/lib/xs_api.c                            |  103 +---
 tools/blktap/lib/xs_api.h                            |    2 
 tools/examples/block                                 |    1 
 tools/examples/xend-config.sxp                       |    5 
 tools/examples/xmexample.hvm                         |    5 
 tools/firmware/acpi/acpi_dsdt.asl                    |   66 +-
 tools/firmware/acpi/acpi_dsdt.c                      |  470 +++++++++----------
 tools/firmware/hvmloader/smbios.c                    |    1 
 tools/ioemu/vl.c                                     |   35 +
 tools/ioemu/vl.h                                     |    4 
 tools/ioemu/vnc.c                                    |   14 
 tools/libxc/xc_load_elf.c                            |    2 
 tools/misc/mbootpack/Makefile                        |   17 
 tools/misc/mbootpack/buildimage.c                    |   19 
 tools/misc/mbootpack/mbootpack.c                     |   20 
 tools/misc/miniterm/miniterm.c                       |   25 -
 tools/python/xen/util/blkif.py                       |    2 
 tools/python/xen/xend/XendDomainInfo.py              |    2 
 tools/python/xen/xend/XendRoot.py                    |    6 
 tools/python/xen/xend/image.py                       |    5 
 tools/python/xen/xm/create.py                        |    9 
 tools/python/xen/xm/main.py                          |    5 
 tools/xenstore/xenstore_client.c                     |   21 
 tools/xenstore/xenstored_transaction.c               |    2 
 xen/arch/x86/Makefile                                |   17 
 xen/arch/x86/domain_build.c                          |    4 
 xen/arch/x86/hvm/hvm.c                               |    4 
 xen/arch/x86/hvm/svm/intr.c                          |    9 
 xen/arch/x86/hvm/svm/svm.c                           |   10 
 xen/arch/x86/hvm/vmx/vmx.c                           |  126 ++---
 xen/arch/x86/microcode.c                             |   11 
 xen/arch/x86/mm/shadow/multi.c                       |  138 ++---
 xen/arch/x86/platform_hypercall.c                    |   16 
 xen/arch/x86/x86_32/asm-offsets.c                    |    1 
 xen/arch/x86/x86_64/asm-offsets.c                    |    1 
 xen/common/elf.c                                     |    2 
 xen/include/asm-x86/hvm/vmx/vmcs.h                   |   15 
 xen/include/asm-x86/hvm/vmx/vmx.h                    |   32 -
 xen/include/asm-x86/msr.h                            |    8 
 xen/include/asm-x86/multicall.h                      |    2 
 xen/include/asm-x86/perfc_defn.h                     |    4 
 62 files changed, 1275 insertions(+), 1217 deletions(-)

diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/arch/i386/mm/ioremap-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/ioremap-xen.c   Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/arch/i386/mm/ioremap-xen.c   Sat Oct 14 13:28:45 
2006 -0600
@@ -28,6 +28,8 @@ static int direct_remap_area_pte_fn(pte_
                                    void *data)
 {
        mmu_update_t **v = (mmu_update_t **)data;
+
+       BUG_ON(!pte_none(*pte));
 
        (*v)->ptr = ((u64)pfn_to_mfn(page_to_pfn(pmd_page)) <<
                     PAGE_SHIFT) | ((unsigned long)pte & ~PAGE_MASK);
@@ -110,11 +112,13 @@ int direct_remap_pfn_range(struct vm_are
                           pgprot_t prot,
                           domid_t  domid)
 {
-       /* Same as remap_pfn_range(). */
-       vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP;
+       if (xen_feature(XENFEAT_auto_translated_physmap))
+               return remap_pfn_range(vma, address, mfn, size, prot);
 
        if (domid == DOMID_SELF)
                return -EINVAL;
+
+       vma->vm_flags |= VM_IO | VM_RESERVED;
 
        vma->vm_mm->context.has_foreign_mappings = 1;
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c
--- a/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Sat Oct 14 13:28:45 
2006 -0600
@@ -478,6 +478,7 @@ struct xen_ia64_privcmd_range {
 };
 
 struct xen_ia64_privcmd_vma {
+       int                             is_privcmd_mmapped;
        struct xen_ia64_privcmd_range*  range;
 
        unsigned long                   num_entries;
@@ -616,12 +617,15 @@ static void
 static void
 xen_ia64_privcmd_vma_open(struct vm_area_struct* vma)
 {
+       struct xen_ia64_privcmd_vma* old_privcmd_vma = (struct 
xen_ia64_privcmd_vma*)vma->vm_private_data;
        struct xen_ia64_privcmd_vma* privcmd_vma = (struct 
xen_ia64_privcmd_vma*)vma->vm_private_data;
        struct xen_ia64_privcmd_range* privcmd_range = privcmd_vma->range;
 
        atomic_inc(&privcmd_range->ref_count);
        // vm_op->open() can't fail.
        privcmd_vma = kmalloc(sizeof(*privcmd_vma), GFP_KERNEL | __GFP_NOFAIL);
+       // copy original value if necessary
+       privcmd_vma->is_privcmd_mmapped = old_privcmd_vma->is_privcmd_mmapped;
 
        __xen_ia64_privcmd_vma_open(vma, privcmd_vma, privcmd_range);
 }
@@ -654,6 +658,14 @@ xen_ia64_privcmd_vma_close(struct vm_are
                kfree(privcmd_range->res);
                vfree(privcmd_range);
        }
+}
+
+int
+privcmd_enforce_singleshot_mapping(struct vm_area_struct *vma)
+{
+       struct xen_ia64_privcmd_vma* privcmd_vma =
+               (struct xen_ia64_privcmd_vma *)vma->vm_private_data;
+       return (xchg(&privcmd_vma->is_privcmd_mmapped, 1) == 0);
 }
 
 int
@@ -681,6 +693,8 @@ privcmd_mmap(struct file * file, struct 
        if (privcmd_vma == NULL) {
                goto out_enomem1;
        }
+       privcmd_vma->is_privcmd_mmapped = 0;
+
        res = kzalloc(sizeof(*res), GFP_KERNEL);
        if (res == NULL) {
                goto out_enomem1;
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c
--- a/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -534,74 +534,86 @@ static int dealloc_pte_fn(
        return 0;
 }
 
-struct page *balloon_alloc_empty_page_range(unsigned long nr_pages)
-{
-       unsigned long vstart, flags;
-       unsigned int  order = get_order(nr_pages * PAGE_SIZE);
-       int ret;
-       unsigned long i;
-       struct page *page;
-
-       vstart = __get_free_pages(GFP_KERNEL, order);
-       if (vstart == 0)
+struct page **alloc_empty_pages_and_pagevec(int nr_pages)
+{
+       unsigned long vaddr, flags;
+       struct page *page, **pagevec;
+       int i, ret;
+
+       pagevec = kmalloc(sizeof(page) * nr_pages, GFP_KERNEL);
+       if (pagevec == NULL)
                return NULL;
 
-       scrub_pages(vstart, 1 << order);
-
+       for (i = 0; i < nr_pages; i++) {
+               page = pagevec[i] = alloc_page(GFP_KERNEL);
+               if (page == NULL)
+                       goto err;
+
+               vaddr = (unsigned long)page_address(page);
+
+               scrub_pages(vaddr, 1);
+
+               balloon_lock(flags);
+
+               if (xen_feature(XENFEAT_auto_translated_physmap)) {
+                       unsigned long gmfn = page_to_pfn(page);
+                       struct xen_memory_reservation reservation = {
+                               .nr_extents   = 1,
+                               .extent_order = 0,
+                               .domid        = DOMID_SELF
+                       };
+                       set_xen_guest_handle(reservation.extent_start, &gmfn);
+                       ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation,
+                                                  &reservation);
+                       if (ret == 1)
+                               ret = 0; /* success */
+               } else {
+                       ret = apply_to_page_range(&init_mm, vaddr, PAGE_SIZE,
+                                                 dealloc_pte_fn, NULL);
+               }
+
+               if (ret != 0) {
+                       balloon_unlock(flags);
+                       __free_page(page);
+                       goto err;
+               }
+
+               totalram_pages = --current_pages;
+
+               balloon_unlock(flags);
+       }
+
+ out:
+       schedule_work(&balloon_worker);
+       flush_tlb_all();
+       return pagevec;
+
+ err:
        balloon_lock(flags);
-       if (xen_feature(XENFEAT_auto_translated_physmap)) {
-               unsigned long gmfn = __pa(vstart) >> PAGE_SHIFT;
-               struct xen_memory_reservation reservation = {
-                       .nr_extents   = 1,
-                       .extent_order = order,
-                       .domid        = DOMID_SELF
-               };
-               set_xen_guest_handle(reservation.extent_start, &gmfn);
-               ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation,
-                                          &reservation);
-               if (ret == -ENOSYS)
-                       goto err;
-               BUG_ON(ret != 1);
-       } else {
-               ret = apply_to_page_range(&init_mm, vstart, PAGE_SIZE << order,
-                                         dealloc_pte_fn, NULL);
-               if (ret == -ENOSYS)
-                       goto err;
-               BUG_ON(ret);
-       }
-       current_pages -= 1UL << order;
-       totalram_pages = current_pages;
+       while (--i >= 0)
+               balloon_append(pagevec[i]);
        balloon_unlock(flags);
-
-       schedule_work(&balloon_worker);
-
-       flush_tlb_all();
-
-       page = virt_to_page(vstart);
-
-       for (i = 0; i < (1UL << order); i++)
-               set_page_count(page + i, 1);
-
-       return page;
-
- err:
-       free_pages(vstart, order);
+       kfree(pagevec);
+       pagevec = NULL;
+       goto out;
+}
+
+void free_empty_pages_and_pagevec(struct page **pagevec, int nr_pages)
+{
+       unsigned long flags;
+       int i;
+
+       if (pagevec == NULL)
+               return;
+
+       balloon_lock(flags);
+       for (i = 0; i < nr_pages; i++) {
+               BUG_ON(page_count(pagevec[i]) != 1);
+               balloon_append(pagevec[i]);
+       }
        balloon_unlock(flags);
-       return NULL;
-}
-
-void balloon_dealloc_empty_page_range(
-       struct page *page, unsigned long nr_pages)
-{
-       unsigned long i, flags;
-       unsigned int  order = get_order(nr_pages * PAGE_SIZE);
-
-       balloon_lock(flags);
-       for (i = 0; i < (1UL << order); i++) {
-               BUG_ON(page_count(page + i) != 1);
-               balloon_append(page + i);
-       }
-       balloon_unlock(flags);
+
+       kfree(pagevec);
 
        schedule_work(&balloon_worker);
 }
@@ -619,8 +631,8 @@ void balloon_release_driver_page(struct 
 }
 
 EXPORT_SYMBOL_GPL(balloon_update_driver_allowance);
-EXPORT_SYMBOL_GPL(balloon_alloc_empty_page_range);
-EXPORT_SYMBOL_GPL(balloon_dealloc_empty_page_range);
+EXPORT_SYMBOL_GPL(alloc_empty_pages_and_pagevec);
+EXPORT_SYMBOL_GPL(free_empty_pages_and_pagevec);
 EXPORT_SYMBOL_GPL(balloon_release_driver_page);
 
 MODULE_LICENSE("Dual BSD/GPL");
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -55,8 +55,6 @@ static int blkif_reqs = 64;
 static int blkif_reqs = 64;
 module_param_named(reqs, blkif_reqs, int, 0);
 MODULE_PARM_DESC(reqs, "Number of blkback requests to allocate");
-
-static int mmap_pages;
 
 /* Run-time switchable: /sys/module/blkback/parameters/ */
 static unsigned int log_stats = 0;
@@ -87,8 +85,7 @@ static DECLARE_WAIT_QUEUE_HEAD(pending_f
 
 #define BLKBACK_INVALID_HANDLE (~0)
 
-static unsigned long mmap_vstart;
-static unsigned long *pending_vaddrs;
+static struct page **pending_pages;
 static grant_handle_t *pending_grant_handles;
 
 static inline int vaddr_pagenr(pending_req_t *req, int seg)
@@ -98,7 +95,8 @@ static inline int vaddr_pagenr(pending_r
 
 static inline unsigned long vaddr(pending_req_t *req, int seg)
 {
-       return pending_vaddrs[vaddr_pagenr(req, seg)];
+       unsigned long pfn = page_to_pfn(pending_pages[vaddr_pagenr(req, seg)]);
+       return (unsigned long)pfn_to_kaddr(pfn);
 }
 
 #define pending_handle(_req, _seg) \
@@ -506,52 +504,43 @@ static void make_response(blkif_t *blkif
 
 static int __init blkif_init(void)
 {
-       struct page *page;
-       int i;
+       int i, mmap_pages;
 
        if (!is_running_on_xen())
                return -ENODEV;
 
-       mmap_pages            = blkif_reqs * BLKIF_MAX_SEGMENTS_PER_REQUEST;
-
-       page = balloon_alloc_empty_page_range(mmap_pages);
-       if (page == NULL)
-               return -ENOMEM;
-       mmap_vstart = (unsigned long)pfn_to_kaddr(page_to_pfn(page));
+       mmap_pages = blkif_reqs * BLKIF_MAX_SEGMENTS_PER_REQUEST;
 
        pending_reqs          = kmalloc(sizeof(pending_reqs[0]) *
                                        blkif_reqs, GFP_KERNEL);
        pending_grant_handles = kmalloc(sizeof(pending_grant_handles[0]) *
                                        mmap_pages, GFP_KERNEL);
-       pending_vaddrs        = kmalloc(sizeof(pending_vaddrs[0]) *
-                                       mmap_pages, GFP_KERNEL);
-       if (!pending_reqs || !pending_grant_handles || !pending_vaddrs) {
-               kfree(pending_reqs);
-               kfree(pending_grant_handles);
-               kfree(pending_vaddrs);
-               printk("%s: out of memory\n", __FUNCTION__);
-               return -ENOMEM;
-       }
+       pending_pages         = alloc_empty_pages_and_pagevec(mmap_pages);
+
+       if (!pending_reqs || !pending_grant_handles || !pending_pages)
+               goto out_of_memory;
+
+       for (i = 0; i < mmap_pages; i++)
+               pending_grant_handles[i] = BLKBACK_INVALID_HANDLE;
 
        blkif_interface_init();
-       
-       printk("%s: reqs=%d, pages=%d, mmap_vstart=0x%lx\n",
-              __FUNCTION__, blkif_reqs, mmap_pages, mmap_vstart);
-       BUG_ON(mmap_vstart == 0);
-       for (i = 0; i < mmap_pages; i++) {
-               pending_vaddrs[i] = mmap_vstart + (i << PAGE_SHIFT);
-               pending_grant_handles[i] = BLKBACK_INVALID_HANDLE;
-       }
 
        memset(pending_reqs, 0, sizeof(pending_reqs));
        INIT_LIST_HEAD(&pending_free);
 
        for (i = 0; i < blkif_reqs; i++)
                list_add_tail(&pending_reqs[i].free_list, &pending_free);
-    
+
        blkif_xenbus_init();
 
        return 0;
+
+ out_of_memory:
+       kfree(pending_reqs);
+       kfree(pending_grant_handles);
+       free_empty_pages_and_pagevec(pending_pages, mmap_pages);
+       printk("%s: out of memory\n", __FUNCTION__);
+       return -ENOMEM;
 }
 
 module_init(blkif_init);
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Sat Oct 14 13:28:45 
2006 -0600
@@ -186,16 +186,18 @@ static inline unsigned int RTN_PEND_IDX(
 
 #define BLKBACK_INVALID_HANDLE (~0)
 
-typedef struct mmap_page {
-       unsigned long start;
-       struct page *mpage;
-} mmap_page_t;
-
-static mmap_page_t mmap_start[MAX_DYNAMIC_MEM];
+static struct page **foreign_pages[MAX_DYNAMIC_MEM];
+static inline unsigned long idx_to_kaddr(
+       unsigned int mmap_idx, unsigned int req_idx, unsigned int sg_idx)
+{
+       unsigned int arr_idx = req_idx*BLKIF_MAX_SEGMENTS_PER_REQUEST + sg_idx;
+       unsigned long pfn = page_to_pfn(foreign_pages[mmap_idx][arr_idx]);
+       return (unsigned long)pfn_to_kaddr(pfn);
+}
+
 static unsigned short mmap_alloc = 0;
 static unsigned short mmap_lock = 0;
 static unsigned short mmap_inuse = 0;
-static unsigned long *pending_addrs[MAX_DYNAMIC_MEM];
 
 /******************************************************************
  * GRANT HANDLES
@@ -726,63 +728,21 @@ static int req_increase(void)
 static int req_increase(void)
 {
        int i, j;
-       struct page *page;
-       int ret;
-
-       ret = -EINVAL;
+
        if (mmap_alloc >= MAX_PENDING_REQS || mmap_lock) 
-               goto done;
-
-#ifdef __ia64__
-       extern unsigned long alloc_empty_foreign_map_page_range(
-               unsigned long pages);
-       mmap_start[mmap_alloc].start = (unsigned long)
-               alloc_empty_foreign_map_page_range(mmap_pages);
-#else /* ! ia64 */
-       page = balloon_alloc_empty_page_range(mmap_pages);
-       ret = -ENOMEM;
-       if (page == NULL) {
-               printk("%s balloon_alloc_empty_page_range gave NULL\n", 
__FUNCTION__);
-               goto done;
-       }
-
-       /* Pin all of the pages. */
-       for (i=0; i<mmap_pages; i++)
-               get_page(&page[i]);
-
-       mmap_start[mmap_alloc].start = 
-               (unsigned long)pfn_to_kaddr(page_to_pfn(page));
-       mmap_start[mmap_alloc].mpage = page;
-
-#endif
-
-       pending_reqs[mmap_alloc]  = kzalloc(sizeof(pending_req_t) *
-                                       blkif_reqs, GFP_KERNEL);
-       pending_addrs[mmap_alloc] = kzalloc(sizeof(unsigned long) *
-                                       mmap_pages, GFP_KERNEL);
-
-       ret = -ENOMEM;
-       if (!pending_reqs[mmap_alloc] || !pending_addrs[mmap_alloc]) {
-               kfree(pending_reqs[mmap_alloc]);
-               kfree(pending_addrs[mmap_alloc]);
-               WPRINTK("%s: out of memory\n", __FUNCTION__);
-               ret = -ENOMEM;
-               goto done;
-       }
-
-       ret = 0;
-
-       DPRINTK("%s: reqs=%d, pages=%d, mmap_vstart=0x%lx\n",
-               __FUNCTION__, blkif_reqs, mmap_pages, 
-              mmap_start[mmap_alloc].start);
-
-       BUG_ON(mmap_start[mmap_alloc].start == 0);
-
-       for (i = 0; i < mmap_pages; i++) 
-               pending_addrs[mmap_alloc][i] = 
-                       mmap_start[mmap_alloc].start + (i << PAGE_SHIFT);
-
-       for (i = 0; i < MAX_PENDING_REQS ; i++) {
+               return -EINVAL;
+
+       pending_reqs[mmap_alloc]  = kzalloc(sizeof(pending_req_t)
+                                           * blkif_reqs, GFP_KERNEL);
+       foreign_pages[mmap_alloc] = alloc_empty_pages_and_pagevec(mmap_pages);
+
+       if (!pending_reqs[mmap_alloc] || !foreign_pages[mmap_alloc])
+               goto out_of_memory;
+
+       DPRINTK("%s: reqs=%d, pages=%d\n",
+               __FUNCTION__, blkif_reqs, mmap_pages);
+
+       for (i = 0; i < MAX_PENDING_REQS; i++) {
                list_add_tail(&pending_reqs[mmap_alloc][i].free_list, 
                              &pending_free);
                pending_reqs[mmap_alloc][i].mem_idx = mmap_alloc;
@@ -793,30 +753,24 @@ static int req_increase(void)
 
        mmap_alloc++;
        DPRINTK("# MMAPs increased to %d\n",mmap_alloc);
-done:
-       return ret;
+       return 0;
+
+ out_of_memory:
+       free_empty_pages_and_pagevec(foreign_pages[mmap_alloc], mmap_pages);
+       kfree(pending_reqs[mmap_alloc]);
+       WPRINTK("%s: out of memory\n", __FUNCTION__);
+       return -ENOMEM;
 }
 
 static void mmap_req_del(int mmap)
 {
-       int i;
-       struct page *page;
-
-       /*Spinlock already acquired*/
+       BUG_ON(!spin_is_locked(&pending_free_lock));
+
        kfree(pending_reqs[mmap]);
-       kfree(pending_addrs[mmap]);
-
-#ifdef __ia64__
-       /*Not sure what goes here yet!*/
-#else
-
-       /* Unpin all of the pages. */
-       page = mmap_start[mmap].mpage;
-       for (i=0; i<mmap_pages; i++)
-               put_page(&page[i]);
-
-       balloon_dealloc_empty_page_range(mmap_start[mmap].mpage, mmap_pages);
-#endif
+       pending_reqs[mmap] = NULL;
+
+       free_empty_pages_and_pagevec(foreign_pages[mmap_alloc], mmap_pages);
+       foreign_pages[mmap] = NULL;
 
        mmap_lock = 0;
        DPRINTK("# MMAPs decreased to %d\n",mmap_alloc);
@@ -887,7 +841,7 @@ static void fast_flush_area(pending_req_
        mmap_idx = req->mem_idx;
 
        for (i = 0; i < req->nr_pages; i++) {
-               kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, k_idx, i);
+               kvaddr = idx_to_kaddr(mmap_idx, k_idx, i);
                uvaddr = MMAP_VADDR(info->user_vstart, u_idx, i);
 
                khandle = &pending_handle(mmap_idx, k_idx, i);
@@ -896,7 +850,7 @@ static void fast_flush_area(pending_req_
                        continue;
                }
                gnttab_set_unmap_op(&unmap[invcount], 
-                       MMAP_VADDR(mmap_start[mmap_idx].start, k_idx, i), 
+                                   idx_to_kaddr(mmap_idx, k_idx, i), 
                                    GNTMAP_host_map, khandle->kernel);
                invcount++;
 
@@ -1030,9 +984,8 @@ static int blktap_read_ufe_ring(tap_blki
                        struct page *pg;
                        int offset;
 
-                       uvaddr  = MMAP_VADDR(info->user_vstart, usr_idx, j);
-                       kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, 
-                                           pending_idx, j);
+                       uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, j);
+                       kvaddr = idx_to_kaddr(mmap_idx, pending_idx, j);
 
                        pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
                        ClearPageReserved(pg);
@@ -1214,8 +1167,7 @@ static void dispatch_rw_block_io(blkif_t
                uint32_t flags;
 
                uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i);
-               kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, 
-                                   pending_idx, i);
+               kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
                page = virt_to_page(kvaddr);
 
                sector = req->sector_number + (8*i);
@@ -1267,8 +1219,7 @@ static void dispatch_rw_block_io(blkif_t
                struct page *pg;
 
                uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i/2);
-               kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, 
-                                   pending_idx, i/2);
+               kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i/2);
 
                if (unlikely(map[i].status != 0)) {
                        WPRINTK("invalid kernel buffer -- "
@@ -1298,8 +1249,7 @@ static void dispatch_rw_block_io(blkif_t
                unsigned long kvaddr;
                struct page *pg;
 
-               kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, 
-                                   pending_idx, i);
+               kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
                pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
                SetPageReserved(pg);
        }
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netback/common.h
--- a/linux-2.6-xen-sparse/drivers/xen/netback/common.h Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/common.h Sat Oct 14 13:28:45 
2006 -0600
@@ -106,7 +106,7 @@ typedef struct netif_st {
 
 void netif_disconnect(netif_t *netif);
 
-netif_t *netif_alloc(domid_t domid, unsigned int handle, u8 be_mac[ETH_ALEN]);
+netif_t *netif_alloc(domid_t domid, unsigned int handle);
 int netif_map(netif_t *netif, unsigned long tx_ring_ref,
              unsigned long rx_ring_ref, unsigned int evtchn);
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netback/interface.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/interface.c      Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/interface.c      Sat Oct 14 
13:28:45 2006 -0600
@@ -62,6 +62,7 @@ static void __netif_down(netif_t *netif)
 {
        disable_irq(netif->irq);
        netif_deschedule_work(netif);
+       del_timer_sync(&netif->credit_timeout);
 }
 
 static int net_open(struct net_device *dev)
@@ -125,7 +126,7 @@ static struct ethtool_ops network_ethtoo
        .get_link = ethtool_op_get_link,
 };
 
-netif_t *netif_alloc(domid_t domid, unsigned int handle, u8 be_mac[ETH_ALEN])
+netif_t *netif_alloc(domid_t domid, unsigned int handle)
 {
        int err = 0, i;
        struct net_device *dev;
@@ -152,6 +153,7 @@ netif_t *netif_alloc(domid_t domid, unsi
        netif->credit_bytes = netif->remaining_credit = ~0UL;
        netif->credit_usec  = 0UL;
        init_timer(&netif->credit_timeout);
+       netif->credit_timeout.expires = jiffies;
 
        dev->hard_start_xmit = netif_be_start_xmit;
        dev->get_stats       = netif_be_get_stats;
@@ -167,20 +169,14 @@ netif_t *netif_alloc(domid_t domid, unsi
                printk(KERN_WARNING "netbk: WARNING: device '%s' has non-zero "
                       "queue length (%lu)!\n", dev->name, dev->tx_queue_len);
 
-       for (i = 0; i < ETH_ALEN; i++)
-               if (be_mac[i] != 0)
-                       break;
-       if (i == ETH_ALEN) {
-               /*
-                * Initialise a dummy MAC address. We choose the numerically
-                * largest non-broadcast address to prevent the address getting
-                * stolen by an Ethernet bridge for STP purposes.
-                * (FE:FF:FF:FF:FF:FF)
-                */ 
-               memset(dev->dev_addr, 0xFF, ETH_ALEN);
-               dev->dev_addr[0] &= ~0x01;
-       } else
-               memcpy(dev->dev_addr, be_mac, ETH_ALEN);
+       /*
+        * Initialise a dummy MAC address. We choose the numerically
+        * largest non-broadcast address to prevent the address getting
+        * stolen by an Ethernet bridge for STP purposes.
+        * (FE:FF:FF:FF:FF:FF)
+        */ 
+       memset(dev->dev_addr, 0xFF, ETH_ALEN);
+       dev->dev_addr[0] &= ~0x01;
 
        rtnl_lock();
        err = register_netdevice(dev);
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netback/netback.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -70,14 +70,15 @@ static struct timer_list net_timer;
 
 static struct sk_buff_head rx_queue;
 
-static unsigned long mmap_vstart;
-#define MMAP_VADDR(_req) (mmap_vstart + ((_req) * PAGE_SIZE))
-
-static void *rx_mmap_area;
+static struct page **mmap_pages;
+static inline unsigned long idx_to_kaddr(unsigned int idx)
+{
+       return (unsigned long)pfn_to_kaddr(page_to_pfn(mmap_pages[idx]));
+}
 
 #define PKT_PROT_LEN 64
 
-static struct {
+static struct pending_tx_info {
        netif_tx_request_t req;
        netif_t *netif;
 } pending_tx_info[MAX_PENDING_REQS];
@@ -373,14 +374,22 @@ static u16 netbk_gop_frag(netif_t *netif
                   flipped. */
                meta->copy = 1;
                copy_gop = npo->copy + npo->copy_prod++;
-               copy_gop->source.domid = DOMID_SELF;
+               copy_gop->flags = GNTCOPY_dest_gref;
+               if (PageForeign(page)) {
+                       struct pending_tx_info *src_pend =
+                               &pending_tx_info[page->index];
+                       copy_gop->source.domid = src_pend->netif->domid;
+                       copy_gop->source.u.ref = src_pend->req.gref;
+                       copy_gop->flags |= GNTCOPY_source_gref;
+               } else {
+                       copy_gop->source.domid = DOMID_SELF;
+                       copy_gop->source.u.gmfn = old_mfn;
+               }
                copy_gop->source.offset = offset;
-               copy_gop->source.u.gmfn = old_mfn;
                copy_gop->dest.domid = netif->domid;
                copy_gop->dest.offset = 0;
                copy_gop->dest.u.ref = req->gref;
                copy_gop->len = size;
-               copy_gop->flags = GNTCOPY_dest_gref;
        } else {
                meta->copy = 0;
                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
@@ -792,10 +801,27 @@ void netif_deschedule_work(netif_t *neti
 }
 
 
+static void tx_add_credit(netif_t *netif)
+{
+       unsigned long max_burst;
+
+       /*
+        * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
+        * Otherwise the interface can seize up due to insufficient credit.
+        */
+       max_burst = RING_GET_REQUEST(&netif->tx, netif->tx.req_cons)->size;
+       max_burst = min(max_burst, 131072UL);
+       max_burst = max(max_burst, netif->credit_bytes);
+
+       netif->remaining_credit = min(netif->remaining_credit +
+                                     netif->credit_bytes,
+                                     max_burst);
+}
+
 static void tx_credit_callback(unsigned long data)
 {
        netif_t *netif = (netif_t *)data;
-       netif->remaining_credit = netif->credit_bytes;
+       tx_add_credit(netif);
        netif_schedule_work(netif);
 }
 
@@ -819,7 +845,7 @@ inline static void net_tx_action_dealloc
        gop = tx_unmap_ops;
        while (dc != dp) {
                pending_idx = dealloc_ring[MASK_PEND_IDX(dc++)];
-               gnttab_set_unmap_op(gop, MMAP_VADDR(pending_idx),
+               gnttab_set_unmap_op(gop, idx_to_kaddr(pending_idx),
                                    GNTMAP_host_map,
                                    grant_tx_handle[pending_idx]);
                gop++;
@@ -857,20 +883,28 @@ static void netbk_tx_err(netif_t *netif,
        netif_put(netif);
 }
 
-static int netbk_count_requests(netif_t *netif, netif_tx_request_t *txp,
-                               int work_to_do)
-{
-       netif_tx_request_t *first = txp;
+static int netbk_count_requests(netif_t *netif, netif_tx_request_t *first,
+                               netif_tx_request_t *txp, int work_to_do)
+{
        RING_IDX cons = netif->tx.req_cons;
        int frags = 0;
 
-       while (txp->flags & NETTXF_more_data) {
+       if (!(first->flags & NETTXF_more_data))
+               return 0;
+
+       do {
                if (frags >= work_to_do) {
                        DPRINTK("Need more frags\n");
                        return -frags;
                }
 
-               txp = RING_GET_REQUEST(&netif->tx, cons + frags);
+               if (unlikely(frags >= MAX_SKB_FRAGS)) {
+                       DPRINTK("Too many frags\n");
+                       return -frags;
+               }
+
+               memcpy(txp, RING_GET_REQUEST(&netif->tx, cons + frags),
+                      sizeof(*txp));
                if (txp->size > first->size) {
                        DPRINTK("Frags galore\n");
                        return -frags;
@@ -884,30 +918,28 @@ static int netbk_count_requests(netif_t 
                                txp->offset, txp->size);
                        return -frags;
                }
-       }
+       } while ((txp++)->flags & NETTXF_more_data);
 
        return frags;
 }
 
 static gnttab_map_grant_ref_t *netbk_get_requests(netif_t *netif,
                                                  struct sk_buff *skb,
+                                                 netif_tx_request_t *txp,
                                                  gnttab_map_grant_ref_t *mop)
 {
        struct skb_shared_info *shinfo = skb_shinfo(skb);
        skb_frag_t *frags = shinfo->frags;
-       netif_tx_request_t *txp;
        unsigned long pending_idx = *((u16 *)skb->data);
-       RING_IDX cons = netif->tx.req_cons;
        int i, start;
 
        /* Skip first skb fragment if it is on same page as header fragment. */
        start = ((unsigned long)shinfo->frags[0].page == pending_idx);
 
-       for (i = start; i < shinfo->nr_frags; i++) {
-               txp = RING_GET_REQUEST(&netif->tx, cons++);
+       for (i = start; i < shinfo->nr_frags; i++, txp++) {
                pending_idx = pending_ring[MASK_PEND_IDX(pending_cons++)];
 
-               gnttab_set_map_op(mop++, MMAP_VADDR(pending_idx),
+               gnttab_set_map_op(mop++, idx_to_kaddr(pending_idx),
                                  GNTMAP_host_map | GNTMAP_readonly,
                                  txp->gref, netif->domid);
 
@@ -940,7 +972,7 @@ static int netbk_tx_check_mop(struct sk_
                netif_put(netif);
        } else {
                set_phys_to_machine(
-                       __pa(MMAP_VADDR(pending_idx)) >> PAGE_SHIFT,
+                       __pa(idx_to_kaddr(pending_idx)) >> PAGE_SHIFT,
                        FOREIGN_FRAME(mop->dev_bus_addr >> PAGE_SHIFT));
                grant_tx_handle[pending_idx] = mop->handle;
        }
@@ -957,7 +989,7 @@ static int netbk_tx_check_mop(struct sk_
                newerr = (++mop)->status;
                if (likely(!newerr)) {
                        set_phys_to_machine(
-                               __pa(MMAP_VADDR(pending_idx))>>PAGE_SHIFT,
+                               __pa(idx_to_kaddr(pending_idx))>>PAGE_SHIFT,
                                FOREIGN_FRAME(mop->dev_bus_addr>>PAGE_SHIFT));
                        grant_tx_handle[pending_idx] = mop->handle;
                        /* Had a previous error? Invalidate this fragment. */
@@ -1005,7 +1037,7 @@ static void netbk_fill_frags(struct sk_b
 
                pending_idx = (unsigned long)frag->page;
                txp = &pending_tx_info[pending_idx].req;
-               frag->page = virt_to_page(MMAP_VADDR(pending_idx));
+               frag->page = virt_to_page(idx_to_kaddr(pending_idx));
                frag->size = txp->size;
                frag->page_offset = txp->offset;
 
@@ -1018,7 +1050,7 @@ int netbk_get_extras(netif_t *netif, str
 int netbk_get_extras(netif_t *netif, struct netif_extra_info *extras,
                     int work_to_do)
 {
-       struct netif_extra_info *extra;
+       struct netif_extra_info extra;
        RING_IDX cons = netif->tx.req_cons;
 
        do {
@@ -1027,18 +1059,18 @@ int netbk_get_extras(netif_t *netif, str
                        return -EBADR;
                }
 
-               extra = (struct netif_extra_info *)
-                       RING_GET_REQUEST(&netif->tx, cons);
-               if (unlikely(!extra->type ||
-                            extra->type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
+               memcpy(&extra, RING_GET_REQUEST(&netif->tx, cons),
+                      sizeof(extra));
+               if (unlikely(!extra.type ||
+                            extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
                        netif->tx.req_cons = ++cons;
-                       DPRINTK("Invalid extra type: %d\n", extra->type);
+                       DPRINTK("Invalid extra type: %d\n", extra.type);
                        return -EINVAL;
                }
 
-               memcpy(&extras[extra->type - 1], extra, sizeof(*extra));
+               memcpy(&extras[extra.type - 1], &extra, sizeof(extra));
                netif->tx.req_cons = ++cons;
-       } while (extra->flags & XEN_NETIF_EXTRA_FLAG_MORE);
+       } while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE);
 
        return work_to_do;
 }
@@ -1073,6 +1105,7 @@ static void net_tx_action(unsigned long 
        struct sk_buff *skb;
        netif_t *netif;
        netif_tx_request_t txreq;
+       netif_tx_request_t txfrags[MAX_SKB_FRAGS];
        struct netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX - 1];
        u16 pending_idx;
        RING_IDX i;
@@ -1101,6 +1134,7 @@ static void net_tx_action(unsigned long 
                i = netif->tx.req_cons;
                rmb(); /* Ensure that we see the request before we copy it. */
                memcpy(&txreq, RING_GET_REQUEST(&netif->tx, i), sizeof(txreq));
+
                /* Credit-based scheduling. */
                if (txreq.size > netif->remaining_credit) {
                        unsigned long now = jiffies;
@@ -1109,25 +1143,27 @@ static void net_tx_action(unsigned long 
                                msecs_to_jiffies(netif->credit_usec / 1000);
 
                        /* Timer could already be pending in rare cases. */
-                       if (timer_pending(&netif->credit_timeout))
-                               break;
+                       if (timer_pending(&netif->credit_timeout)) {
+                               netif_put(netif);
+                               continue;
+                       }
 
                        /* Passed the point where we can replenish credit? */
                        if (time_after_eq(now, next_credit)) {
                                netif->credit_timeout.expires = now;
-                               netif->remaining_credit = netif->credit_bytes;
+                               tx_add_credit(netif);
                        }
 
                        /* Still too big to send right now? Set a callback. */
                        if (txreq.size > netif->remaining_credit) {
-                               netif->remaining_credit = 0;
                                netif->credit_timeout.data     =
                                        (unsigned long)netif;
                                netif->credit_timeout.function =
                                        tx_credit_callback;
                                __mod_timer(&netif->credit_timeout,
                                            next_credit);
-                               break;
+                               netif_put(netif);
+                               continue;
                        }
                }
                netif->remaining_credit -= txreq.size;
@@ -1146,18 +1182,12 @@ static void net_tx_action(unsigned long 
                        }
                }
 
-               ret = netbk_count_requests(netif, &txreq, work_to_do);
+               ret = netbk_count_requests(netif, &txreq, txfrags, work_to_do);
                if (unlikely(ret < 0)) {
                        netbk_tx_err(netif, &txreq, i - ret);
                        continue;
                }
                i += ret;
-
-               if (unlikely(ret > MAX_SKB_FRAGS)) {
-                       DPRINTK("Too many frags\n");
-                       netbk_tx_err(netif, &txreq, i);
-                       continue;
-               }
 
                if (unlikely(txreq.size < ETH_HLEN)) {
                        DPRINTK("Bad packet size: %d\n", txreq.size);
@@ -1201,7 +1231,7 @@ static void net_tx_action(unsigned long 
                        }
                }
 
-               gnttab_set_map_op(mop, MMAP_VADDR(pending_idx),
+               gnttab_set_map_op(mop, idx_to_kaddr(pending_idx),
                                  GNTMAP_host_map | GNTMAP_readonly,
                                  txreq.gref, netif->domid);
                mop++;
@@ -1227,7 +1257,7 @@ static void net_tx_action(unsigned long 
 
                pending_cons++;
 
-               mop = netbk_get_requests(netif, skb, mop);
+               mop = netbk_get_requests(netif, skb, txfrags, mop);
 
                netif->tx.req_cons = i;
                netif_schedule_work(netif);
@@ -1260,8 +1290,8 @@ static void net_tx_action(unsigned long 
                }
 
                data_len = skb->len;
-               memcpy(skb->data, 
-                      (void *)(MMAP_VADDR(pending_idx)|txp->offset),
+               memcpy(skb->data,
+                      (void *)(idx_to_kaddr(pending_idx)|txp->offset),
                       data_len);
                if (data_len < txp->size) {
                        /* Append the packet payload as a fragment. */
@@ -1315,18 +1345,10 @@ static void netif_idx_release(u16 pendin
 
 static void netif_page_release(struct page *page)
 {
-       u16 pending_idx = page - virt_to_page(mmap_vstart);
-
        /* Ready for next use. */
        set_page_count(page, 1);
 
-       netif_idx_release(pending_idx);
-}
-
-static void netif_rx_page_release(struct page *page)
-{
-       /* Ready for next use. */
-       set_page_count(page, 1);
+       netif_idx_release(page->index);
 }
 
 irqreturn_t netif_be_int(int irq, void *dev_id, struct pt_regs *regs)
@@ -1446,27 +1468,17 @@ static int __init netback_init(void)
        init_timer(&net_timer);
        net_timer.data = 0;
        net_timer.function = net_alarm;
-    
-       page = balloon_alloc_empty_page_range(MAX_PENDING_REQS);
-       if (page == NULL)
+
+       mmap_pages = alloc_empty_pages_and_pagevec(MAX_PENDING_REQS);
+       if (mmap_pages == NULL) {
+               printk("%s: out of memory\n", __FUNCTION__);
                return -ENOMEM;
-
-       mmap_vstart = (unsigned long)pfn_to_kaddr(page_to_pfn(page));
+       }
 
        for (i = 0; i < MAX_PENDING_REQS; i++) {
-               page = virt_to_page(MMAP_VADDR(i));
-               set_page_count(page, 1);
+               page = mmap_pages[i];
                SetPageForeign(page, netif_page_release);
-       }
-
-       page = balloon_alloc_empty_page_range(NET_RX_RING_SIZE);
-       BUG_ON(page == NULL);
-       rx_mmap_area = pfn_to_kaddr(page_to_pfn(page));
-
-       for (i = 0; i < NET_RX_RING_SIZE; i++) {
-               page = virt_to_page(rx_mmap_area + (i * PAGE_SIZE));
-               set_page_count(page, 1);
-               SetPageForeign(page, netif_rx_page_release);
+               page->index = i;
        }
 
        pending_cons = 0;
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Sat Oct 14 13:28:45 
2006 -0600
@@ -28,29 +28,20 @@
     printk("netback/xenbus (%s:%d) " fmt ".\n", __FUNCTION__, __LINE__, ##args)
 #endif
 
-struct backend_info
-{
+struct backend_info {
        struct xenbus_device *dev;
        netif_t *netif;
-       struct xenbus_watch backend_watch;
        enum xenbus_state frontend_state;
 };
 
 static int connect_rings(struct backend_info *);
 static void connect(struct backend_info *);
-static void maybe_connect(struct backend_info *);
-static void backend_changed(struct xenbus_watch *, const char **,
-                           unsigned int);
+static void backend_create_netif(struct backend_info *be);
 
 static int netback_remove(struct xenbus_device *dev)
 {
        struct backend_info *be = dev->dev.driver_data;
 
-       if (be->backend_watch.node) {
-               unregister_xenbus_watch(&be->backend_watch);
-               kfree(be->backend_watch.node);
-               be->backend_watch.node = NULL;
-       }
        if (be->netif) {
                netif_disconnect(be->netif);
                be->netif = NULL;
@@ -63,8 +54,7 @@ static int netback_remove(struct xenbus_
 
 /**
  * Entry point to this code when a new device is created.  Allocate the basic
- * structures, and watch the store waiting for the hotplug scripts to tell us
- * the device's handle.  Switch to InitWait.
+ * structures and switch to InitWait.
  */
 static int netback_probe(struct xenbus_device *dev,
                         const struct xenbus_device_id *id)
@@ -83,11 +73,6 @@ static int netback_probe(struct xenbus_d
        be->dev = dev;
        dev->dev.driver_data = be;
 
-       err = xenbus_watch_path2(dev, dev->nodename, "handle",
-                                &be->backend_watch, backend_changed);
-       if (err)
-               goto fail;
-
        do {
                err = xenbus_transaction_start(&xbt);
                if (err) {
@@ -108,7 +93,8 @@ static int netback_probe(struct xenbus_d
                        goto abort_transaction;
                }
 
-               err = xenbus_printf(xbt, dev->nodename, "feature-rx-copy", 
"%d", 1);
+               err = xenbus_printf(xbt, dev->nodename,
+                                   "feature-rx-copy", "%d", 1);
                if (err) {
                        message = "writing feature-copying";
                        goto abort_transaction;
@@ -123,9 +109,11 @@ static int netback_probe(struct xenbus_d
        }
 
        err = xenbus_switch_state(dev, XenbusStateInitWait);
-       if (err) {
+       if (err)
                goto fail;
-       }
+
+       /* This kicks hotplug scripts, so do it immediately. */
+       backend_create_netif(be);
 
        return 0;
 
@@ -175,48 +163,30 @@ static int netback_uevent(struct xenbus_
 }
 
 
-/**
- * Callback received when the hotplug scripts have placed the handle node.
- * Read it, and create a netif structure.  If the frontend is ready, connect.
- */
-static void backend_changed(struct xenbus_watch *watch,
-                           const char **vec, unsigned int len)
+static void backend_create_netif(struct backend_info *be)
 {
        int err;
        long handle;
-       struct backend_info *be
-               = container_of(watch, struct backend_info, backend_watch);
        struct xenbus_device *dev = be->dev;
 
-       DPRINTK("");
+       if (be->netif != NULL)
+               return;
 
        err = xenbus_scanf(XBT_NIL, dev->nodename, "handle", "%li", &handle);
-       if (XENBUS_EXIST_ERR(err)) {
-               /* Since this watch will fire once immediately after it is
-                  registered, we expect this.  Ignore it, and wait for the
-                  hotplug scripts. */
-               return;
-       }
        if (err != 1) {
                xenbus_dev_fatal(dev, err, "reading handle");
                return;
        }
 
-       if (be->netif == NULL) {
-               u8 be_mac[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 };
-
-               be->netif = netif_alloc(dev->otherend_id, handle, be_mac);
-               if (IS_ERR(be->netif)) {
-                       err = PTR_ERR(be->netif);
-                       be->netif = NULL;
-                       xenbus_dev_fatal(dev, err, "creating interface");
-                       return;
-               }
-
-               kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
-
-               maybe_connect(be);
-       }
+       be->netif = netif_alloc(dev->otherend_id, handle);
+       if (IS_ERR(be->netif)) {
+               err = PTR_ERR(be->netif);
+               be->netif = NULL;
+               xenbus_dev_fatal(dev, err, "creating interface");
+               return;
+       }
+
+       kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
 }
 
 
@@ -249,11 +219,9 @@ static void frontend_changed(struct xenb
                break;
 
        case XenbusStateConnected:
-               if (!be->netif) {
-                       /* reconnect: setup be->netif */
-                       backend_changed(&be->backend_watch, NULL, 0);
-               }
-               maybe_connect(be);
+               backend_create_netif(be);
+               if (be->netif)
+                       connect(be);
                break;
 
        case XenbusStateClosing:
@@ -279,15 +247,6 @@ static void frontend_changed(struct xenb
 }
 
 
-/* ** Connection ** */
-
-
-static void maybe_connect(struct backend_info *be)
-{
-       if (be->netif && (be->frontend_state == XenbusStateConnected))
-               connect(be);
-}
-
 static void xen_net_read_rate(struct xenbus_device *dev,
                              unsigned long *bytes, unsigned long *usec)
 {
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Sat Oct 14 
13:28:45 2006 -0600
@@ -47,6 +47,7 @@
 #include <linux/in.h>
 #include <linux/if_ether.h>
 #include <linux/io.h>
+#include <linux/moduleparam.h>
 #include <net/sock.h>
 #include <net/pkt_sched.h>
 #include <net/arp.h>
@@ -85,17 +86,42 @@ static const int MODPARM_rx_flip = 0;
 #define RX_COPY_THRESHOLD 256
 
 /* If we don't have GSO, fake things up so that we never try to use it. */
-#ifndef NETIF_F_GSO
-#define netif_needs_gso(dev, skb)      0
-#define dev_disable_gso_features(dev)  ((void)0)
-#else
+#if defined(NETIF_F_GSO)
 #define HAVE_GSO                       1
+#define HAVE_TSO                       1 /* TSO is a subset of GSO */
 static inline void dev_disable_gso_features(struct net_device *dev)
 {
        /* Turn off all GSO bits except ROBUST. */
        dev->features &= (1 << NETIF_F_GSO_SHIFT) - 1;
        dev->features |= NETIF_F_GSO_ROBUST;
 }
+#elif defined(NETIF_F_TSO)
+#define HAVE_TSO                       1
+#define gso_size tso_size
+#define gso_segs tso_segs
+static inline void dev_disable_gso_features(struct net_device *dev)
+{
+       /* Turn off all TSO bits. */
+       dev->features &= ~NETIF_F_TSO;
+}
+static inline int skb_is_gso(const struct sk_buff *skb)
+{
+        return skb_shinfo(skb)->tso_size;
+}
+static inline int skb_gso_ok(struct sk_buff *skb, int features)
+{
+        return (features & NETIF_F_TSO);
+}
+
+static inline int netif_needs_gso(struct net_device *dev, struct sk_buff *skb)
+{
+        return skb_is_gso(skb) &&
+               (!skb_gso_ok(skb, dev->features) ||
+                unlikely(skb->ip_summed != CHECKSUM_HW));
+}
+#else
+#define netif_needs_gso(dev, skb)      0
+#define dev_disable_gso_features(dev)  ((void)0)
 #endif
 
 #define GRANT_INVALID_REF      0
@@ -115,7 +141,6 @@ struct netfront_info {
        spinlock_t   tx_lock;
        spinlock_t   rx_lock;
 
-       unsigned int handle;
        unsigned int evtchn, irq;
        unsigned int copying_receiver;
 
@@ -139,7 +164,7 @@ struct netfront_info {
        grant_ref_t gref_tx_head;
        grant_ref_t grant_tx_ref[NET_TX_RING_SIZE + 1];
        grant_ref_t gref_rx_head;
-       grant_ref_t grant_rx_ref[NET_TX_RING_SIZE];
+       grant_ref_t grant_rx_ref[NET_RX_RING_SIZE];
 
        struct xenbus_device *xbdev;
        int tx_ring_ref;
@@ -204,9 +229,8 @@ static inline grant_ref_t xennet_get_rx_
 #define WPRINTK(fmt, args...)                          \
        printk(KERN_WARNING "netfront: " fmt, ##args)
 
-static int talk_to_backend(struct xenbus_device *, struct netfront_info *);
 static int setup_device(struct xenbus_device *, struct netfront_info *);
-static struct net_device *create_netdev(int, int, struct xenbus_device *);
+static struct net_device *create_netdev(struct xenbus_device *);
 
 static void netfront_closing(struct xenbus_device *);
 
@@ -216,7 +240,7 @@ static void close_netdev(struct netfront
 static void close_netdev(struct netfront_info *);
 static void netif_free(struct netfront_info *);
 
-static void network_connect(struct net_device *);
+static int network_connect(struct net_device *);
 static void network_tx_buf_gc(struct net_device *);
 static void network_alloc_rx_buffers(struct net_device *);
 static int send_fake_arp(struct net_device *);
@@ -239,8 +263,7 @@ static inline int xennet_can_sg(struct n
 /**
  * Entry point to this code when a new device is created.  Allocate the basic
  * structures and the ring buffers for communication with the backend, and
- * inform the backend of the appropriate details for those.  Switch to
- * Connected state.
+ * inform the backend of the appropriate details for those.
  */
 static int __devinit netfront_probe(struct xenbus_device *dev,
                                    const struct xenbus_device_id *id)
@@ -248,32 +271,8 @@ static int __devinit netfront_probe(stru
        int err;
        struct net_device *netdev;
        struct netfront_info *info;
-       unsigned int handle, feature_rx_copy, feature_rx_flip, use_copy;
-
-       err = xenbus_scanf(XBT_NIL, dev->nodename, "handle", "%u", &handle);
-       if (err != 1) {
-               xenbus_dev_fatal(dev, err, "reading handle");
-               return err;
-       }
-
-       err = xenbus_scanf(XBT_NIL, dev->otherend, "feature-rx-copy", "%u",
-                          &feature_rx_copy);
-       if (err != 1)
-               feature_rx_copy = 0;
-       err = xenbus_scanf(XBT_NIL, dev->otherend, "feature-rx-flip", "%u",
-                          &feature_rx_flip);
-       if (err != 1)
-               feature_rx_flip = 1;
-
-       /*
-        * Copy packets on receive path if:
-        *  (a) This was requested by user, and the backend supports it; or
-        *  (b) Flipping was requested, but this is unsupported by the backend.
-        */
-       use_copy = (MODPARM_rx_copy && feature_rx_copy) ||
-               (MODPARM_rx_flip && !feature_rx_flip);
-
-       netdev = create_netdev(handle, use_copy, dev);
+
+       netdev = create_netdev(dev);
        if (IS_ERR(netdev)) {
                err = PTR_ERR(netdev);
                xenbus_dev_fatal(dev, err, "creating netdev");
@@ -283,23 +282,13 @@ static int __devinit netfront_probe(stru
        info = netdev_priv(netdev);
        dev->dev.driver_data = info;
 
-       err = talk_to_backend(dev, info);
-       if (err)
-               goto fail_backend;
-
        err = open_netdev(info);
        if (err)
-               goto fail_open;
-
-       IPRINTK("Created netdev %s with %sing receive path.\n",
-               netdev->name, info->copying_receiver ? "copy" : "flipp");
+               goto fail;
 
        return 0;
 
- fail_open:
-       xennet_sysfs_delif(info->netdev);
-       unregister_netdev(netdev);
- fail_backend:
+ fail:
        free_netdev(netdev);
        dev->dev.driver_data = NULL;
        return err;
@@ -319,7 +308,7 @@ static int netfront_resume(struct xenbus
        DPRINTK("%s\n", dev->nodename);
 
        netif_disconnect_backend(info);
-       return talk_to_backend(dev, info);
+       return 0;
 }
 
 static int xen_net_read_mac(struct xenbus_device *dev, u8 mac[])
@@ -408,7 +397,7 @@ again:
                goto abort_transaction;
        }
 
-#ifdef HAVE_GSO
+#ifdef HAVE_TSO
        err = xenbus_printf(xbt, dev->nodename, "feature-gso-tcpv4", "%d", 1);
        if (err) {
                message = "writing feature-gso-tcpv4";
@@ -430,7 +419,7 @@ again:
        xenbus_transaction_end(xbt, 1);
        xenbus_dev_fatal(dev, err, "%s", message);
  destroy_ring:
-       netif_free(info);
+       netif_disconnect_backend(info);
  out:
        return err;
 }
@@ -520,7 +509,10 @@ static void backend_changed(struct xenbu
                break;
 
        case XenbusStateInitWait:
-               network_connect(netdev);
+               if (network_connect(netdev) != 0) {
+                       netif_free(np);
+                       break;
+               }
                xenbus_switch_state(dev, XenbusStateConnected);
                (void)send_fake_arp(netdev);
                break;
@@ -940,7 +932,7 @@ static int network_start_xmit(struct sk_
                tx->flags |= NETTXF_data_validated;
 #endif
 
-#ifdef HAVE_GSO
+#ifdef HAVE_TSO
        if (skb_shinfo(skb)->gso_size) {
                struct netif_extra_info *gso = (struct netif_extra_info *)
                        RING_GET_REQUEST(&np->tx, ++i);
@@ -1094,6 +1086,7 @@ static int xennet_get_responses(struct n
                        if (net_ratelimit())
                                WPRINTK("rx->offset: %x, size: %u\n",
                                        rx->offset, rx->status);
+                       xennet_move_rx_slot(np, skb, ref);
                        err = -EINVAL;
                        goto next;
                }
@@ -1104,7 +1097,8 @@ static int xennet_get_responses(struct n
                 * situation to the system controller to reboot the backed.
                 */
                if (ref == GRANT_INVALID_REF) {
-                       WPRINTK("Bad rx response id %d.\n", rx->id);
+                       if (net_ratelimit())
+                               WPRINTK("Bad rx response id %d.\n", rx->id);
                        err = -EINVAL;
                        goto next;
                }
@@ -1176,6 +1170,9 @@ next:
                err = -E2BIG;
        }
 
+       if (unlikely(err))
+               np->rx.rsp_cons = cons + frags;
+
        *pages_flipped_p = pages_flipped;
 
        return err;
@@ -1228,12 +1225,14 @@ static int xennet_set_skb_gso(struct sk_
                return -EINVAL;
        }
 
+#ifdef HAVE_TSO
+       skb_shinfo(skb)->gso_size = gso->u.gso.size;
 #ifdef HAVE_GSO
-       skb_shinfo(skb)->gso_size = gso->u.gso.size;
        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
 
        /* Header must be checked, and gso_segs computed. */
        skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+#endif
        skb_shinfo(skb)->gso_segs = 0;
 
        return 0;
@@ -1278,9 +1277,9 @@ static int netif_poll(struct net_device 
        rp = np->rx.sring->rsp_prod;
        rmb(); /* Ensure we see queued responses up to 'rp'. */
 
-       for (i = np->rx.rsp_cons, work_done = 0;
-            (i != rp) && (work_done < budget);
-            np->rx.rsp_cons = ++i, work_done++) {
+       i = np->rx.rsp_cons;
+       work_done = 0;
+       while ((i != rp) && (work_done < budget)) {
                memcpy(rx, RING_GET_RESPONSE(&np->rx, i), sizeof(*rx));
                memset(extras, 0, sizeof(extras));
 
@@ -1288,12 +1287,11 @@ static int netif_poll(struct net_device 
                                           &pages_flipped);
 
                if (unlikely(err)) {
-err:
-                       i = np->rx.rsp_cons + skb_queue_len(&tmpq) - 1;
-                       work_done--;
+err:   
                        while ((skb = __skb_dequeue(&tmpq)))
                                __skb_queue_tail(&errq, skb);
                        np->stats.rx_errors++;
+                       i = np->rx.rsp_cons;
                        continue;
                }
 
@@ -1305,6 +1303,7 @@ err:
 
                        if (unlikely(xennet_set_skb_gso(skb, gso))) {
                                __skb_queue_head(&tmpq, skb);
+                               np->rx.rsp_cons += skb_queue_len(&tmpq);
                                goto err;
                        }
                }
@@ -1368,6 +1367,9 @@ err:
                np->stats.rx_bytes += skb->len;
 
                __skb_queue_tail(&rxq, skb);
+
+               np->rx.rsp_cons = ++i;
+               work_done++;
        }
 
        if (pages_flipped) {
@@ -1584,7 +1586,7 @@ static int xennet_set_sg(struct net_devi
 
 static int xennet_set_tso(struct net_device *dev, u32 data)
 {
-#ifdef HAVE_GSO
+#ifdef HAVE_TSO
        if (data) {
                struct netfront_info *np = netdev_priv(dev);
                int val;
@@ -1615,15 +1617,40 @@ static void xennet_set_features(struct n
                xennet_set_tso(dev, 1);
 }
 
-static void network_connect(struct net_device *dev)
+static int network_connect(struct net_device *dev)
 {
        struct netfront_info *np = netdev_priv(dev);
-       int i, requeue_idx;
+       int i, requeue_idx, err;
        struct sk_buff *skb;
        grant_ref_t ref;
        netif_rx_request_t *req;
+       unsigned int feature_rx_copy, feature_rx_flip;
+
+       err = xenbus_scanf(XBT_NIL, np->xbdev->otherend,
+                          "feature-rx-copy", "%u", &feature_rx_copy);
+       if (err != 1)
+               feature_rx_copy = 0;
+       err = xenbus_scanf(XBT_NIL, np->xbdev->otherend,
+                          "feature-rx-flip", "%u", &feature_rx_flip);
+       if (err != 1)
+               feature_rx_flip = 1;
+
+       /*
+        * Copy packets on receive path if:
+        *  (a) This was requested by user, and the backend supports it; or
+        *  (b) Flipping was requested, but this is unsupported by the backend.
+        */
+       np->copying_receiver = ((MODPARM_rx_copy && feature_rx_copy) ||
+                               (MODPARM_rx_flip && !feature_rx_flip));
+
+       err = talk_to_backend(np->xbdev, np);
+       if (err)
+               return err;
 
        xennet_set_features(dev);
+
+       IPRINTK("device %s has %sing receive path.\n",
+               dev->name, np->copying_receiver ? "copy" : "flipp");
 
        spin_lock_irq(&np->tx_lock);
        spin_lock(&np->rx_lock);
@@ -1680,6 +1707,8 @@ static void network_connect(struct net_d
 
        spin_unlock(&np->rx_lock);
        spin_unlock_irq(&np->tx_lock);
+
+       return 0;
 }
 
 static void netif_uninit(struct net_device *dev)
@@ -1845,8 +1874,7 @@ static void network_set_multicast_list(s
 {
 }
 
-static struct net_device * __devinit
-create_netdev(int handle, int copying_receiver, struct xenbus_device *dev)
+static struct net_device * __devinit create_netdev(struct xenbus_device *dev)
 {
        int i, err = 0;
        struct net_device *netdev = NULL;
@@ -1860,9 +1888,7 @@ create_netdev(int handle, int copying_re
        }
 
        np                   = netdev_priv(netdev);
-       np->handle           = handle;
        np->xbdev            = dev;
-       np->copying_receiver = copying_receiver;
 
        netif_carrier_off(netdev);
 
@@ -1993,10 +2019,12 @@ static int open_netdev(struct netfront_i
 
        err = xennet_sysfs_addif(info->netdev);
        if (err) {
-               /* This can be non-fatal: it only means no tuning parameters */
+               unregister_netdev(info->netdev);
                printk(KERN_WARNING "%s: add sysfs failed err=%d\n",
                       __FUNCTION__, err);
-       }
+               return err;
+       }
+
        return 0;
 }
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c
--- a/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -34,6 +34,10 @@
 
 static struct proc_dir_entry *privcmd_intf;
 static struct proc_dir_entry *capabilities_intf;
+
+#ifndef HAVE_ARCH_PRIVCMD_MMAP
+static int privcmd_enforce_singleshot_mapping(struct vm_area_struct *vma);
+#endif
 
 static int privcmd_ioctl(struct inode *inode, struct file *file,
                         unsigned int cmd, unsigned long data)
@@ -89,10 +93,12 @@ static int privcmd_ioctl(struct inode *i
        break;
 
        case IOCTL_PRIVCMD_MMAP: {
-#define PRIVCMD_MMAP_SZ 32
                privcmd_mmap_t mmapcmd;
-               privcmd_mmap_entry_t msg[PRIVCMD_MMAP_SZ];
+               privcmd_mmap_entry_t msg;
                privcmd_mmap_entry_t __user *p;
+               struct mm_struct *mm = current->mm;
+               struct vm_area_struct *vma;
+               unsigned long va;
                int i, rc;
 
                if (!is_initial_xendomain())
@@ -102,47 +108,60 @@ static int privcmd_ioctl(struct inode *i
                        return -EFAULT;
 
                p = mmapcmd.entry;
-
-               for (i = 0; i < mmapcmd.num;
-                    i += PRIVCMD_MMAP_SZ, p += PRIVCMD_MMAP_SZ) {
-                       int j, n = ((mmapcmd.num-i)>PRIVCMD_MMAP_SZ)?
-                               PRIVCMD_MMAP_SZ:(mmapcmd.num-i);
-
-                       if (copy_from_user(&msg, p,
-                                          n*sizeof(privcmd_mmap_entry_t)))
-                               return -EFAULT;
-     
-                       for (j = 0; j < n; j++) {
-                               struct vm_area_struct *vma = 
-                                       find_vma( current->mm, msg[j].va );
-
-                               if (!vma)
-                                       return -EINVAL;
-
-                               if (msg[j].va > PAGE_OFFSET)
-                                       return -EINVAL;
-
-                               if ((msg[j].va + (msg[j].npages << PAGE_SHIFT))
-                                   > vma->vm_end )
-                                       return -EINVAL;
-
-                               if ((rc = direct_remap_pfn_range(
-                                       vma,
-                                       msg[j].va&PAGE_MASK, 
-                                       msg[j].mfn, 
-                                       msg[j].npages<<PAGE_SHIFT, 
-                                       vma->vm_page_prot,
-                                       mmapcmd.dom)) < 0)
-                                       return rc;
-                       }
-               }
-               ret = 0;
+               if (copy_from_user(&msg, p, sizeof(msg)))
+                       return -EFAULT;
+
+               down_read(&mm->mmap_sem);
+
+               vma = find_vma(mm, msg.va);
+               rc = -EINVAL;
+               if (!vma || (msg.va != vma->vm_start) ||
+                   !privcmd_enforce_singleshot_mapping(vma))
+                       goto mmap_out;
+
+               va = vma->vm_start;
+
+               for (i = 0; i < mmapcmd.num; i++) {
+                       rc = -EFAULT;
+                       if (copy_from_user(&msg, p, sizeof(msg)))
+                               goto mmap_out;
+
+                       /* Do not allow range to wrap the address space. */
+                       rc = -EINVAL;
+                       if ((msg.npages > (LONG_MAX >> PAGE_SHIFT)) ||
+                           ((unsigned long)(msg.npages << PAGE_SHIFT) >= -va))
+                               goto mmap_out;
+
+                       /* Range chunks must be contiguous in va space. */
+                       if ((msg.va != va) ||
+                           ((msg.va+(msg.npages<<PAGE_SHIFT)) > vma->vm_end))
+                               goto mmap_out;
+
+                       if ((rc = direct_remap_pfn_range(
+                               vma,
+                               msg.va & PAGE_MASK, 
+                               msg.mfn, 
+                               msg.npages << PAGE_SHIFT, 
+                               vma->vm_page_prot,
+                               mmapcmd.dom)) < 0)
+                               goto mmap_out;
+
+                       p++;
+                       va += msg.npages << PAGE_SHIFT;
+               }
+
+               rc = 0;
+
+       mmap_out:
+               up_read(&mm->mmap_sem);
+               ret = rc;
        }
        break;
 
        case IOCTL_PRIVCMD_MMAPBATCH: {
                privcmd_mmapbatch_t m;
-               struct vm_area_struct *vma = NULL;
+               struct mm_struct *mm = current->mm;
+               struct vm_area_struct *vma;
                xen_pfn_t __user *p;
                unsigned long addr, mfn;
                int i;
@@ -150,37 +169,31 @@ static int privcmd_ioctl(struct inode *i
                if (!is_initial_xendomain())
                        return -EPERM;
 
-               if (copy_from_user(&m, udata, sizeof(m))) {
-                       ret = -EFAULT;
-                       goto batch_err;
-               }
-
-               if (m.dom == DOMID_SELF) {
-                       ret = -EINVAL;
-                       goto batch_err;
-               }
-
-               vma = find_vma(current->mm, m.addr);
-               if (!vma) {
-                       ret = -EINVAL;
-                       goto batch_err;
-               }
-
-               if (m.addr > PAGE_OFFSET) {
-                       ret = -EFAULT;
-                       goto batch_err;
-               }
-
-               if ((m.addr + (m.num<<PAGE_SHIFT)) > vma->vm_end) {
-                       ret = -EFAULT;
-                       goto batch_err;
+               if (copy_from_user(&m, udata, sizeof(m)))
+                       return -EFAULT;
+
+               if ((m.num <= 0) || (m.num > (LONG_MAX >> PAGE_SHIFT)))
+                       return -EINVAL;
+
+               down_read(&mm->mmap_sem);
+
+               vma = find_vma(mm, m.addr);
+               if (!vma ||
+                   (m.addr != vma->vm_start) ||
+                   ((m.addr + ((unsigned long)m.num<<PAGE_SHIFT)) !=
+                    vma->vm_end) ||
+                   !privcmd_enforce_singleshot_mapping(vma)) {
+                       up_read(&mm->mmap_sem);
+                       return -EINVAL;
                }
 
                p = m.arr;
                addr = m.addr;
                for (i = 0; i < m.num; i++, addr += PAGE_SIZE, p++) {
-                       if (get_user(mfn, p))
+                       if (get_user(mfn, p)) {
+                               up_read(&mm->mmap_sem);
                                return -EFAULT;
+                       }
 
                        ret = direct_remap_pfn_range(vma, addr & PAGE_MASK,
                                                     mfn, PAGE_SIZE,
@@ -189,15 +202,8 @@ static int privcmd_ioctl(struct inode *i
                                put_user(0xF0000000 | mfn, p);
                }
 
+               up_read(&mm->mmap_sem);
                ret = 0;
-               break;
-
-       batch_err:
-               printk("batch_err ret=%d vma=%p addr=%lx "
-                      "num=%d arr=%p %lx-%lx\n", 
-                      ret, vma, (unsigned long)m.addr, m.num, m.arr,
-                      vma ? vma->vm_start : 0, vma ? vma->vm_end : 0);
-               break;
        }
        break;
 
@@ -210,12 +216,34 @@ static int privcmd_ioctl(struct inode *i
 }
 
 #ifndef HAVE_ARCH_PRIVCMD_MMAP
+static struct page *privcmd_nopage(struct vm_area_struct *vma,
+                                  unsigned long address,
+                                  int *type)
+{
+       return NOPAGE_SIGBUS;
+}
+
+static struct vm_operations_struct privcmd_vm_ops = {
+       .nopage = privcmd_nopage
+};
+
 static int privcmd_mmap(struct file * file, struct vm_area_struct * vma)
 {
+       /* Unsupported for auto-translate guests. */
+       if (xen_feature(XENFEAT_auto_translated_physmap))
+               return -ENOSYS;
+
        /* DONTCOPY is essential for Xen as copy_page_range is broken. */
        vma->vm_flags |= VM_RESERVED | VM_IO | VM_DONTCOPY;
+       vma->vm_ops = &privcmd_vm_ops;
+       vma->vm_private_data = NULL;
 
        return 0;
+}
+
+static int privcmd_enforce_singleshot_mapping(struct vm_area_struct *vma)
+{
+       return (xchg(&vma->vm_private_data, (void *)1) == NULL);
 }
 #endif
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/tpmback/common.h
--- a/linux-2.6-xen-sparse/drivers/xen/tpmback/common.h Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/common.h Sat Oct 14 13:28:45 
2006 -0600
@@ -46,11 +46,10 @@ typedef struct tpmif_st {
        atomic_t refcnt;
 
        struct backend_info *bi;
-       unsigned long mmap_vstart;
 
        grant_handle_t shmem_handle;
        grant_ref_t shmem_ref;
-       struct page *pagerange;
+       struct page **mmap_pages;
 
        char devname[20];
 } tpmif_t;
@@ -80,6 +79,9 @@ int vtpm_release_packets(tpmif_t * tpmif
 
 extern int num_frontends;
 
-#define MMAP_VADDR(t,_req) ((t)->mmap_vstart + ((_req) * PAGE_SIZE))
+static inline unsigned long idx_to_kaddr(tpmif_t *t, unsigned int idx)
+{
+       return (unsigned long)pfn_to_kaddr(page_to_pfn(t->mmap_pages[idx]));
+}
 
 #endif /* __TPMIF__BACKEND__COMMON_H__ */
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c
--- a/linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c      Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c      Sat Oct 14 
13:28:45 2006 -0600
@@ -25,8 +25,8 @@ static tpmif_t *alloc_tpmif(domid_t domi
        tpmif_t *tpmif;
 
        tpmif = kmem_cache_alloc(tpmif_cachep, GFP_KERNEL);
-       if (!tpmif)
-               return ERR_PTR(-ENOMEM);
+       if (tpmif == NULL)
+               goto out_of_memory;
 
        memset(tpmif, 0, sizeof (*tpmif));
        tpmif->domid = domid;
@@ -35,22 +35,27 @@ static tpmif_t *alloc_tpmif(domid_t domi
        snprintf(tpmif->devname, sizeof(tpmif->devname), "tpmif%d", domid);
        atomic_set(&tpmif->refcnt, 1);
 
-       tpmif->pagerange = balloon_alloc_empty_page_range(TPMIF_TX_RING_SIZE);
-       BUG_ON(tpmif->pagerange == NULL);
-       tpmif->mmap_vstart = (unsigned long)pfn_to_kaddr(
-                                           page_to_pfn(tpmif->pagerange));
+       tpmif->mmap_pages = alloc_empty_pages_and_pagevec(TPMIF_TX_RING_SIZE);
+       if (tpmif->mmap_pages == NULL)
+               goto out_of_memory;
 
        list_add(&tpmif->tpmif_list, &tpmif_list);
        num_frontends++;
 
        return tpmif;
+
+ out_of_memory:
+       if (tpmif != NULL)
+               kmem_cache_free(tpmif_cachep, tpmif);
+       printk("%s: out of memory\n", __FUNCTION__);
+       return ERR_PTR(-ENOMEM);
 }
 
 static void free_tpmif(tpmif_t * tpmif)
 {
        num_frontends--;
        list_del(&tpmif->tpmif_list);
-       balloon_dealloc_empty_page_range(tpmif->pagerange, TPMIF_TX_RING_SIZE);
+       free_empty_pages_and_pagevec(tpmif->mmap_pages, TPMIF_TX_RING_SIZE);
        kmem_cache_free(tpmif_cachep, tpmif);
 }
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c
--- a/linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -253,7 +253,7 @@ int _packet_write(struct packet *pak,
                        return 0;
                }
 
-               gnttab_set_map_op(&map_op, MMAP_VADDR(tpmif, i),
+               gnttab_set_map_op(&map_op, idx_to_kaddr(tpmif, i),
                                  GNTMAP_host_map, tx->ref, tpmif->domid);
 
                if (unlikely(HYPERVISOR_grant_table_op(GNTTABOP_map_grant_ref,
@@ -270,7 +270,7 @@ int _packet_write(struct packet *pak,
 
                tocopy = min_t(size_t, size - offset, PAGE_SIZE);
 
-               if (copy_from_buffer((void *)(MMAP_VADDR(tpmif, i) |
+               if (copy_from_buffer((void *)(idx_to_kaddr(tpmif, i) |
                                              (tx->addr & ~PAGE_MASK)),
                                     &data[offset], tocopy, isuserbuffer)) {
                        tpmif_put(tpmif);
@@ -278,7 +278,7 @@ int _packet_write(struct packet *pak,
                }
                tx->size = tocopy;
 
-               gnttab_set_unmap_op(&unmap_op, MMAP_VADDR(tpmif, i),
+               gnttab_set_unmap_op(&unmap_op, idx_to_kaddr(tpmif, i),
                                    GNTMAP_host_map, handle);
 
                if (unlikely
@@ -391,7 +391,7 @@ static int packet_read_shmem(struct pack
 
                tx = &tpmif->tx->ring[i].req;
 
-               gnttab_set_map_op(&map_op, MMAP_VADDR(tpmif, i),
+               gnttab_set_map_op(&map_op, idx_to_kaddr(tpmif, i),
                                  GNTMAP_host_map, tx->ref, tpmif->domid);
 
                if (unlikely(HYPERVISOR_grant_table_op(GNTTABOP_map_grant_ref,
@@ -414,10 +414,10 @@ static int packet_read_shmem(struct pack
                }
 
                DPRINTK("Copying from mapped memory at %08lx\n",
-                       (unsigned long)(MMAP_VADDR(tpmif, i) |
+                       (unsigned long)(idx_to_kaddr(tpmif, i) |
                                        (tx->addr & ~PAGE_MASK)));
 
-               src = (void *)(MMAP_VADDR(tpmif, i) |
+               src = (void *)(idx_to_kaddr(tpmif, i) |
                               ((tx->addr & ~PAGE_MASK) + pg_offset));
                if (copy_to_buffer(&buffer[offset],
                                   src, to_copy, isuserbuffer)) {
@@ -428,7 +428,7 @@ static int packet_read_shmem(struct pack
                        tpmif->domid, buffer[offset], buffer[offset + 1],
                        buffer[offset + 2], buffer[offset + 3]);
 
-               gnttab_set_unmap_op(&unmap_op, MMAP_VADDR(tpmif, i),
+               gnttab_set_unmap_op(&unmap_op, idx_to_kaddr(tpmif, i),
                                    GNTMAP_host_map, handle);
 
                if (unlikely
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Sat Oct 14 
13:28:45 2006 -0600
@@ -127,6 +127,7 @@ int direct_remap_pfn_range(struct vm_are
                           pgprot_t prot,
                           domid_t  domid);
 struct file;
+int privcmd_enforce_singleshot_mapping(struct vm_area_struct *vma);
 int privcmd_mmap(struct file * file, struct vm_area_struct * vma);
 #define HAVE_ARCH_PRIVCMD_MMAP
 
diff -r 5176c3ea3293 -r b725c9e51a7c linux-2.6-xen-sparse/include/xen/balloon.h
--- a/linux-2.6-xen-sparse/include/xen/balloon.h        Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/include/xen/balloon.h        Sat Oct 14 13:28:45 
2006 -0600
@@ -38,23 +38,13 @@
  * Inform the balloon driver that it should allow some slop for device-driver
  * memory activities.
  */
-void
-balloon_update_driver_allowance(
-       long delta);
+void balloon_update_driver_allowance(long delta);
 
-/* Allocate an empty low-memory page range. */
-struct page *
-balloon_alloc_empty_page_range(
-       unsigned long nr_pages);
+/* Allocate/free a set of empty pages in low memory (i.e., no RAM mapped). */
+struct page **alloc_empty_pages_and_pagevec(int nr_pages);
+void free_empty_pages_and_pagevec(struct page **pagevec, int nr_pages);
 
-/* Deallocate an empty page range, adding to the balloon. */
-void
-balloon_dealloc_empty_page_range(
-       struct page *page, unsigned long nr_pages);
-
-void
-balloon_release_driver_page(
-       struct page *page);
+void balloon_release_driver_page(struct page *page);
 
 /*
  * Prevent the balloon driver from changing the memory reservation during
diff -r 5176c3ea3293 -r b725c9e51a7c linux-2.6-xen-sparse/mm/memory.c
--- a/linux-2.6-xen-sparse/mm/memory.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/mm/memory.c  Sat Oct 14 13:28:45 2006 -0600
@@ -390,7 +390,7 @@ struct page *vm_normal_page(struct vm_ar
 
        if (vma->vm_flags & VM_PFNMAP) {
                unsigned long off = (addr - vma->vm_start) >> PAGE_SHIFT;
-               if ((pfn == vma->vm_pgoff + off) || !pfn_valid(pfn))
+               if (pfn == vma->vm_pgoff + off)
                        return NULL;
                if (!is_cow_mapping(vma->vm_flags))
                        return NULL;
@@ -405,7 +405,8 @@ struct page *vm_normal_page(struct vm_ar
         * Remove this test eventually!
         */
        if (unlikely(!pfn_valid(pfn))) {
-               print_bad_pte(vma, pte, addr);
+               if (!(vma->vm_flags & VM_RESERVED))
+                       print_bad_pte(vma, pte, addr);
                return NULL;
        }
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/drivers/Makefile
--- a/tools/blktap/drivers/Makefile     Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/drivers/Makefile     Sat Oct 14 13:28:45 2006 -0600
@@ -10,11 +10,8 @@ INSTALL_DIR  = /usr/sbin
 INSTALL_DIR  = /usr/sbin
 LIBAIO_DIR   = ../../libaio/src
 
-CFLAGS   += -fPIC
-CFLAGS   += -Wall
 CFLAGS   += -Werror
 CFLAGS   += -Wno-unused
-CFLAGS   += -g3
 CFLAGS   += -fno-strict-aliasing
 CFLAGS   += -I $(XEN_LIBXC) -I $(LIBAIO_DIR)
 CFLAGS   += $(INCLUDES) -I. -I../../xenstore 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/drivers/blktapctrl.c
--- a/tools/blktap/drivers/blktapctrl.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/drivers/blktapctrl.c Sat Oct 14 13:28:45 2006 -0600
@@ -73,11 +73,6 @@ static int write_msg(int fd, int msgtype
 static int write_msg(int fd, int msgtype, void *ptr, void *ptr2);
 static int read_msg(int fd, int msgtype, void *ptr);
 static driver_list_entry_t *active_disks[MAX_DISK_TYPES];
-
-void sig_handler(int sig)
-{
-       run = 0;        
-}
 
 static void init_driver_list(void)
 {
@@ -669,6 +664,7 @@ int main(int argc, char *argv[])
                goto open_failed;
        }
 
+
  retry:
        /* Set up store connection and watch. */
        h = xs_daemon_open();
@@ -682,15 +678,11 @@ int main(int argc, char *argv[])
                 } else goto open_failed;
        }
        
-       ret = add_blockdevice_probe_watch(h, "Domain-0");
+       ret = setup_probe_watch(h);
        if (ret != 0) {
                DPRINTF("Failed adding device probewatch\n");
-                if (count < MAX_ATTEMPTS) {
-                        count++;
-                        sleep(2);
-                        xs_daemon_close(h);
-                        goto retry;
-                } else goto open_failed;
+               xs_daemon_close(h);
+               goto open_failed;
        }
 
        ioctl(ctlfd, BLKTAP_IOCTL_SETMODE, BLKTAP_MODE_INTERPOSE );
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/lib/blktaplib.h
--- a/tools/blktap/lib/blktaplib.h      Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/lib/blktaplib.h      Sat Oct 14 13:28:45 2006 -0600
@@ -193,8 +193,8 @@ typedef struct msg_pid {
 #define CTLMSG_PID_RSP     10
 
 /* xenstore/xenbus: */
-extern int add_blockdevice_probe_watch(struct xs_handle *h, 
-                                       const char *domname);
+#define DOMNAME "Domain-0"
+int setup_probe_watch(struct xs_handle *h);
 int xs_fire_next_watch(struct xs_handle *h);
 
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/lib/xenbus.c
--- a/tools/blktap/lib/xenbus.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/lib/xenbus.c Sat Oct 14 13:28:45 2006 -0600
@@ -166,60 +166,58 @@ static void ueblktap_setup(struct xs_han
                goto fail;
        }
 
-        deverr = xs_gather(h, bepath, "physical-device", "%li", &pdev, NULL);
-        if (!deverr) {
-                DPRINTF("pdev set to %ld\n",pdev);
-                if (be->pdev && be->pdev != pdev) {
-                        DPRINTF("changing physical-device not supported");
-                        goto fail;
-                }
-                be->pdev = pdev;
-        }
-
-        /*Check to see if device is to be opened read-only*/
-        asprintf(&path, "%s/%s", bepath, "read-only");
-        if (xs_exists(h, path))
-                be->readonly = 1;
-
-        if (be->blkif == NULL) {
-
-                /* Front end dir is a number, which is used as the handle. */
-                p = strrchr(be->frontpath, '/') + 1;
-                handle = strtoul(p, NULL, 0);
-
-                be->blkif = alloc_blkif(be->frontend_id);
-       
-                if (be->blkif == NULL)
-                        goto fail;
+       deverr = xs_gather(h, bepath, "physical-device", "%li", &pdev, NULL);
+       if (!deverr) {
+               DPRINTF("pdev set to %ld\n",pdev);
+               if (be->pdev && be->pdev != pdev) {
+                       DPRINTF("changing physical-device not supported");
+                       goto fail;
+               }
+               be->pdev = pdev;
+       }
+
+       /* Check to see if device is to be opened read-only. */
+       asprintf(&path, "%s/%s", bepath, "read-only");
+       if (xs_exists(h, path))
+               be->readonly = 1;
+
+       if (be->blkif == NULL) {
+               /* Front end dir is a number, which is used as the handle. */
+               p = strrchr(be->frontpath, '/') + 1;
+               handle = strtoul(p, NULL, 0);
+
+               be->blkif = alloc_blkif(be->frontend_id);
+               if (be->blkif == NULL)
+                       goto fail;
 
                be->blkif->be_id = get_be_id(bepath);
                
-                /*Insert device specific info*/
-                blk = malloc(sizeof(blkif_info_t));
+               /* Insert device specific info, */
+               blk = malloc(sizeof(blkif_info_t));
                if (!blk) {
                        DPRINTF("Out of memory - blkif_info_t\n");
                        goto fail;
                }
-                er = xs_gather(h, bepath, "params", NULL, &blk->params, NULL);
-                if (er)
-                        goto fail;
-                be->blkif->info = blk;
+               er = xs_gather(h, bepath, "params", NULL, &blk->params, NULL);
+               if (er)
+                       goto fail;
+               be->blkif->info = blk;
                
-                if (deverr) {
-                        /*Dev number was not available, try to set manually*/
-                        pdev = convert_dev_name_to_num(blk->params);
-                        be->pdev = pdev;
-                }
-
-                er = blkif_init(be->blkif, handle, be->pdev, be->readonly);
-
-                if (er != 0) {
-                        DPRINTF("Unable to open device %s\n",blk->params);
-                       goto fail;
-               }
-
-                DPRINTF("[BECHG]: ADDED A NEW BLKIF (%s)\n", bepath);
-        }      
+               if (deverr) {
+                       /*Dev number was not available, try to set manually*/
+                       pdev = convert_dev_name_to_num(blk->params);
+                       be->pdev = pdev;
+               }
+
+               er = blkif_init(be->blkif, handle, be->pdev, be->readonly);
+               if (er != 0) {
+                       DPRINTF("Unable to open device %s\n",blk->params);
+                       goto fail;
+               }
+
+               DPRINTF("[BECHG]: ADDED A NEW BLKIF (%s)\n", bepath);
+       }
+
        /* Supply the information about the device to xenstore */
        er = xs_printf(h, be->backpath, "sectors", "%lu",
                        be->blkif->ops->get_size(be->blkif));
@@ -283,10 +281,10 @@ static void ueblktap_probe(struct xs_han
         *asserts that xenstore structure is always 7 levels deep
         *e.g. /local/domain/0/backend/vbd/1/2049
         */
-        len = strsep_len(bepath, '/', 7);
-        if (len < 0) 
-               goto free_be;     
-        bepath[len] = '\0';
+       len = strsep_len(bepath, '/', 7);
+       if (len < 0) 
+               goto free_be;
+       bepath[len] = '\0';
        
        be = malloc(sizeof(*be));
        if (!be) {
@@ -318,22 +316,21 @@ static void ueblktap_probe(struct xs_han
                if ( (be != NULL) && (be->blkif != NULL) ) 
                        backend_remove(h, be);
                else goto free_be;
-               if (bepath)
+               if (bepath)
                        free(bepath);
                return;
        }
        
-        /* Are we already tracking this device? */
-        if (be_exists_be(bepath)) {
+       /* Are we already tracking this device? */
+       if (be_exists_be(bepath))
                goto free_be;
-       }
        
        be->backpath = bepath;
-               be->frontpath = frontend;
-       
-        list_add(&be->list, &belist);
-       
-        DPRINTF("[PROBE]\tADDED NEW DEVICE (%s)\n", bepath);
+       be->frontpath = frontend;
+       
+       list_add(&be->list, &belist);
+       
+       DPRINTF("[PROBE]\tADDED NEW DEVICE (%s)\n", bepath);
        DPRINTF("\tFRONTEND (%s),(%ld)\n", frontend,be->frontend_id);
        
        ueblktap_setup(h, bepath);      
@@ -342,11 +339,10 @@ static void ueblktap_probe(struct xs_han
  free_be:
        if (frontend)
                free(frontend);
-        if (bepath)
+       if (bepath)
                free(bepath);
        if (be) 
                free(be);
-       return;
 }
 
 /**
@@ -356,16 +352,10 @@ static void ueblktap_probe(struct xs_han
  *are created, we initalise the state and attach a disk.
  */
 
-int add_blockdevice_probe_watch(struct xs_handle *h, const char *domname)
-{
-       char *domid, *path;
+int add_blockdevice_probe_watch(struct xs_handle *h, const char *domid)
+{
+       char *path;
        struct xenbus_watch *vbd_watch;
-       int er;
-       
-       domid = get_dom_domid(h, domname);
-
-       DPRINTF("%s: %s\n", 
-               domname, (domid != NULL) ? domid : "[ not found! ]");
        
        asprintf(&path, "/local/domain/%s/backend/tap", domid);
        if (path == NULL) 
@@ -378,10 +368,67 @@ int add_blockdevice_probe_watch(struct x
        }       
        vbd_watch->node     = path;
        vbd_watch->callback = ueblktap_probe;
-       er = register_xenbus_watch(h, vbd_watch);
-       if (er == 0) {
+       if (register_xenbus_watch(h, vbd_watch) != 0) {
                DPRINTF("ERROR: adding vbd probe watch %s\n", path);
                return -EINVAL;
        }
        return 0;
 }
+
+/* Asynch callback to check for /local/domain/<DOMID>/name */
+void check_dom(struct xs_handle *h, struct xenbus_watch *w, 
+              const char *bepath_im)
+{
+       char *domid;
+
+       domid = get_dom_domid(h);
+       if (domid == NULL)
+               return;
+
+       add_blockdevice_probe_watch(h, domid);
+       free(domid);
+       unregister_xenbus_watch(h, w);
+}
+
+/* We must wait for xend to register /local/domain/<DOMID> */
+int watch_for_domid(struct xs_handle *h)
+{
+       struct xenbus_watch *domid_watch;
+       char *path = NULL;
+
+       asprintf(&path, "/local/domain");
+       if (path == NULL) 
+               return -ENOMEM;
+
+       domid_watch = malloc(sizeof(struct xenbus_watch));
+       if (domid_watch == NULL) {
+               DPRINTF("ERROR: unable to malloc domid_watch [%s]\n", path);
+               return -EINVAL;
+       }       
+
+       domid_watch->node     = path;
+       domid_watch->callback = check_dom;
+
+       if (register_xenbus_watch(h, domid_watch) != 0) {
+               DPRINTF("ERROR: adding vbd probe watch %s\n", path);
+               return -EINVAL;
+       }
+
+       DPRINTF("Set async watch for /local/domain\n");
+
+       return 0;
+}
+
+int setup_probe_watch(struct xs_handle *h)
+{
+       char *domid;
+       int ret;
+       
+       domid = get_dom_domid(h);
+       if (domid == NULL)
+               return watch_for_domid(h);
+
+       ret = add_blockdevice_probe_watch(h, domid);
+       free(domid);
+       return ret;
+}
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/lib/xs_api.c
--- a/tools/blktap/lib/xs_api.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/lib/xs_api.c Sat Oct 14 13:28:45 2006 -0600
@@ -106,7 +106,7 @@ again:
        if (!xs_transaction_end(xs, xth, ret)) {
                if (ret == 0 && errno == EAGAIN)
                        goto again;
-                else
+               else
                        ret = errno;
        }
 
@@ -118,25 +118,25 @@ int xs_printf(struct xs_handle *h, const
 int xs_printf(struct xs_handle *h, const char *dir, const char *node, 
              const char *fmt, ...)
 {
-        char *buf, *path;
-        va_list ap;
-        int ret;
-       
-        va_start(ap, fmt);
-        ret = vasprintf(&buf, fmt, ap);
-        va_end(ap);
-       
-        asprintf(&path, "%s/%s", dir, node);
-       
-        if ( (path == NULL) || (buf == NULL) )
+       char *buf, *path;
+       va_list ap;
+       int ret;
+       
+       va_start(ap, fmt);
+       ret = vasprintf(&buf, fmt, ap);
+       va_end(ap);
+       
+       asprintf(&path, "%s/%s", dir, node);
+       
+       if ((path == NULL) || (buf == NULL))
                return 0;
 
-        ret = xs_write(h, XBT_NULL, path, buf, strlen(buf)+1);
-       
-        free(buf);
-        free(path);
-       
-        return ret;
+       ret = xs_write(h, XBT_NULL, path, buf, strlen(buf)+1);
+       
+       free(buf);
+       free(path);
+       
+       return ret;
 }
 
 
@@ -165,7 +165,7 @@ int xs_exists(struct xs_handle *h, const
  * This assumes that the domain name we are looking for is unique. 
  * Name parameter Domain-0 
  */
-char *get_dom_domid(struct xs_handle *h, const char *name)
+char *get_dom_domid(struct xs_handle *h)
 {
        char **e, *val, *domid = NULL;
        unsigned int num, len;
@@ -179,7 +179,9 @@ char *get_dom_domid(struct xs_handle *h,
        }
        
        e = xs_directory(h, xth, "/local/domain", &num);
-       
+       if (e == NULL)
+               return NULL;
+
        for (i = 0; (i < num) && (domid == NULL); i++) {
                asprintf(&path, "/local/domain/%s/name", e[i]);
                val = xs_read(h, xth, path, &len);
@@ -187,7 +189,7 @@ char *get_dom_domid(struct xs_handle *h,
                if (val == NULL)
                        continue;
                
-               if (strcmp(val, name) == 0) {
+               if (strcmp(val, DOMNAME) == 0) {
                        /* match! */
                        asprintf(&path, "/local/domain/%s/domid", e[i]);
                        domid = xs_read(h, xth, path, &len);
@@ -249,12 +251,12 @@ int convert_dev_name_to_num(char *name) 
                ret = BASE_DEV_VAL;
        }
 
-        free(p_sd);
-        free(p_hd);
-        free(p_xvd);
-        free(p_plx);
-        free(alpha);
-        
+       free(p_sd);
+       free(p_hd);
+       free(p_xvd);
+       free(p_plx);
+       free(alpha);
+
        return ret;
 }
 
@@ -281,42 +283,39 @@ int register_xenbus_watch(struct xs_hand
 {
        /* Pointer in ascii is the token. */
        char token[sizeof(watch) * 2 + 1];
-       int er;
-       
+
        sprintf(token, "%lX", (long)watch);
-       if (find_watch(token)) 
-       {
+       if (find_watch(token)) {
                DPRINTF("watch collision!\n");
                return -EINVAL;
        }
        
-       er = xs_watch(h, watch->node, token);
-       if (er != 0) {
-               list_add(&watch->list, &watches);
-       } 
-        
-       return er;
+       if (!xs_watch(h, watch->node, token)) {
+               DPRINTF("unable to set watch!\n");
+               return -EINVAL;
+       }
+
+       list_add(&watch->list, &watches);
+
+       return 0;
 }
 
 int unregister_xenbus_watch(struct xs_handle *h, struct xenbus_watch *watch)
 {
        char token[sizeof(watch) * 2 + 1];
-       int er;
        
        sprintf(token, "%lX", (long)watch);
-       if (!find_watch(token))
-       {
+       if (!find_watch(token)) {
                DPRINTF("no such watch!\n");
                return -EINVAL;
        }
-       
-       
-       er = xs_unwatch(h, watch->node, token);
+
+       if (!xs_unwatch(h, watch->node, token))
+               DPRINTF("XENBUS Failed to release watch %s: %i\n",
+                       watch->node, er);
+
        list_del(&watch->list);
        
-       if (er == 0)
-               DPRINTF("XENBUS Failed to release watch %s: %i\n",
-                    watch->node, er);
        return 0;
 }
 
@@ -354,14 +353,10 @@ int xs_fire_next_watch(struct xs_handle 
        token = res[XS_WATCH_TOKEN];
        
        w = find_watch(token);
-       if (!w)
-       {
-               DPRINTF("unregistered watch fired\n");
-               goto done;
-       }
-       w->callback(h, w, node);
-       
- done:
+       if (w)
+               w->callback(h, w, node);
+
        free(res);
+
        return 1;
 }
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/lib/xs_api.h
--- a/tools/blktap/lib/xs_api.h Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/lib/xs_api.h Sat Oct 14 13:28:45 2006 -0600
@@ -42,7 +42,7 @@ int xs_printf(struct xs_handle *h, const
 int xs_printf(struct xs_handle *h, const char *dir, const char *node, 
              const char *fmt, ...);
 int xs_exists(struct xs_handle *h, const char *path);
-char *get_dom_domid(struct xs_handle *h, const char *name);
+char *get_dom_domid(struct xs_handle *h);
 int convert_dev_name_to_num(char *name);
 int register_xenbus_watch(struct xs_handle *h, struct xenbus_watch *watch);
 int unregister_xenbus_watch(struct xs_handle *h, struct xenbus_watch *watch);
diff -r 5176c3ea3293 -r b725c9e51a7c tools/examples/block
--- a/tools/examples/block      Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/examples/block      Sat Oct 14 13:28:45 2006 -0600
@@ -377,7 +377,6 @@ mount it read-write in a guest domain."
       "")
         claim_lock "block"
         success
-        echo happy gun \"$t\" >>/tmp/block.$$
         release_lock "block"
        ;;
     esac
diff -r 5176c3ea3293 -r b725c9e51a7c tools/examples/xend-config.sxp
--- a/tools/examples/xend-config.sxp    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/examples/xend-config.sxp    Sat Oct 14 13:28:45 2006 -0600
@@ -130,3 +130,8 @@
 
 # The tool used for initiating virtual TPM migration
 #(external-migration-tool '')
+
+# The interface for VNC servers to listen on. Defaults
+# to 127.0.0.1  To restore old 'listen everywhere' behaviour
+# set this to 0.0.0.0
+#(vnc-listen '127.0.0.1')
diff -r 5176c3ea3293 -r b725c9e51a7c tools/examples/xmexample.hvm
--- a/tools/examples/xmexample.hvm      Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/examples/xmexample.hvm      Sat Oct 14 13:28:45 2006 -0600
@@ -132,6 +132,11 @@ vnc=1
 vnc=1
 
 #----------------------------------------------------------------------------
+# address that should be listened on for the VNC server if vnc is set.
+# default is to use 'vnc-listen' setting from /etc/xen/xend-config.sxp
+#vnclisten="127.0.0.1"
+
+#----------------------------------------------------------------------------
 # set VNC display number, default = domid
 #vncdisplay=1
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/firmware/acpi/acpi_dsdt.asl
--- a/tools/firmware/acpi/acpi_dsdt.asl Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/firmware/acpi/acpi_dsdt.asl Sat Oct 14 13:28:45 2006 -0600
@@ -115,20 +115,15 @@ DefinitionBlock ("DSDT.aml", "DSDT", 1, 
                         0x0000,
                         0xF300)
 
-                /* reserve what device model consumed for PCI VGA device       
 */
+                /* reserve memory for pci devices */
 
                     DWordMemory (ResourceConsumer, PosDecode, MinFixed, 
MaxFixed, Cacheable, ReadWrite,
                         0x00000000,
                         0xF0000000,
-                        0xF1FFFFFF,
+                        0xF4FFFFFF,
                         0x00000000,
-                        0x02000000)
-                    DWordMemory (ResourceConsumer, PosDecode, MinFixed, 
MaxFixed, Cacheable, ReadWrite,
-                        0x00000000,
-                        0xF2000000,
-                        0xF2000FFF,
-                        0x00000000,
-                        0x00001000)
+                        0x05000000)
+
                 })
                 Return (PRT0)
             }
@@ -299,38 +294,43 @@ DefinitionBlock ("DSDT.aml", "DSDT", 1, 
                Return (PRTP)  
                } // end _PRT
 
-        Name(PRTP, Package(){
-                        Package(){0x0000ffff, 0, \_SB.PCI0.LNKA, 0}, // Slot 
1, INTA
-                        Package(){0x0000ffff, 1, \_SB.PCI0.LNKB, 0}, // Slot 
1, INTB
-                        Package(){0x0000ffff, 2, \_SB.PCI0.LNKC, 0}, // Slot 
1, INTC
-                        Package(){0x0000ffff, 3, \_SB.PCI0.LNKD, 0}, // Slot 
1, INTD
-
-                        Package(){0x0001ffff, 0, \_SB.PCI0.LNKB, 0}, // Slot 
2, INTB
-                        Package(){0x0001ffff, 1, \_SB.PCI0.LNKC, 0}, // Slot 
2, INTC
-                        Package(){0x0001ffff, 2, \_SB.PCI0.LNKD, 0}, // Slot 
2, INTD
-                        Package(){0x0001ffff, 3, \_SB.PCI0.LNKA, 0}, // Slot 
2, INTA
+        Name(PRTP, Package() {
+                        // Slot 1, INTA - INTD
+                        Package(){0x0000ffff, 0, \_SB.PCI0.LNKA, 0},
+                        Package(){0x0000ffff, 1, \_SB.PCI0.LNKB, 0},
+                        Package(){0x0000ffff, 2, \_SB.PCI0.LNKC, 0},
+                        Package(){0x0000ffff, 3, \_SB.PCI0.LNKD, 0},
+
+                        // Slot 2, INTA - INTD
+                        Package(){0x0001ffff, 0, \_SB.PCI0.LNKB, 0},
+                        Package(){0x0001ffff, 1, \_SB.PCI0.LNKC, 0},
+                        Package(){0x0001ffff, 2, \_SB.PCI0.LNKD, 0},
+                        Package(){0x0001ffff, 3, \_SB.PCI0.LNKA, 0},
                         
-                        Package(){0x0002ffff, 0, \_SB.PCI0.LNKC, 0}, // Slot 
3, INTC
-                        Package(){0x0002ffff, 1, \_SB.PCI0.LNKD, 0}, // Slot 
3, INTD
-                        Package(){0x0002ffff, 2, \_SB.PCI0.LNKA, 0}, // Slot 
3, INTA
-                        Package(){0x0002ffff, 3, \_SB.PCI0.LNKB, 0}, // Slot 
3, INTB
+                        // Slot 3, INTA - INTD
+                        Package(){0x0002ffff, 0, \_SB.PCI0.LNKC, 0},
+                        Package(){0x0002ffff, 1, \_SB.PCI0.LNKD, 0},
+                        Package(){0x0002ffff, 2, \_SB.PCI0.LNKA, 0},
+                        Package(){0x0002ffff, 3, \_SB.PCI0.LNKB, 0},
                         
-                        Package(){0x0003ffff, 0, \_SB.PCI0.LNKD, 0}, // Slot 
2, INTD
-                        Package(){0x0003ffff, 1, \_SB.PCI0.LNKA, 0}, // Slot 
2, INTA
-                        Package(){0x0003ffff, 2, \_SB.PCI0.LNKB, 0}, // Slot 
2, INTB
-                        Package(){0x0003ffff, 3, \_SB.PCI0.LNKC, 0}, // Slot 
2, INTC
+                        // Slot 4, INTA - INTD
+                        Package(){0x0003ffff, 0, \_SB.PCI0.LNKD, 0},
+                        Package(){0x0003ffff, 1, \_SB.PCI0.LNKA, 0},
+                        Package(){0x0003ffff, 2, \_SB.PCI0.LNKB, 0},
+                        Package(){0x0003ffff, 3, \_SB.PCI0.LNKC, 0},
                         
+                        // Slot 5, INTA - INTD
+                        Package(){0x0004ffff, 0, \_SB.PCI0.LNKA, 0},
+                        Package(){0x0004ffff, 1, \_SB.PCI0.LNKB, 0},
+                        Package(){0x0004ffff, 2, \_SB.PCI0.LNKC, 0},
+                        Package(){0x0004ffff, 3, \_SB.PCI0.LNKD, 0},
                         }
             )
         Name(PRTA, Package(){
-                        Package(){0x0001ffff, 0, 0, 5}, // Device 1, INTA
-
+                        Package(){0x0001ffff, 0, 0, 5},  // Device 1, INTA
                         Package(){0x0002ffff, 0, 0, 7},  // Device 2, INTA
-                       
                         Package(){0x0003ffff, 0, 0, 10}, // Device 3, INTA
-
-                        Package(){0x0004ffff, 0, 0, 11},  // Device 4, INTA    
                            
-                        
+                        Package(){0x0004ffff, 0, 0, 11}, // Device 4, INTA
                         }
             )
             
diff -r 5176c3ea3293 -r b725c9e51a7c tools/firmware/acpi/acpi_dsdt.c
--- a/tools/firmware/acpi/acpi_dsdt.c   Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/firmware/acpi/acpi_dsdt.c   Sat Oct 14 13:28:45 2006 -0600
@@ -1,19 +1,19 @@
 /*
  * 
  * Intel ACPI Component Architecture
- * ASL Optimizing Compiler / AML Disassembler version 20050513 [Jun  8 2005]
+ * ASL Optimizing Compiler / AML Disassembler version 20050513 [Oct 12 2006]
  * Copyright (C) 2000 - 2005 Intel Corporation
  * Supports ACPI Specification Revision 3.0
  * 
- * Compilation of "acpi_dsdt.asl" - Mon Aug 14 18:15:09 2006
+ * Compilation of "acpi_dsdt.asl" - Thu Oct 12 14:08:49 2006
  * 
  * C source code output
  *
  */
 unsigned char AmlCode[] = 
 {
-    0x44,0x53,0x44,0x54,0xBA,0x08,0x00,0x00,  /* 00000000    "DSDT...." */
-    0x01,0x1D,0x49,0x4E,0x54,0x45,0x4C,0x00,  /* 00000008    "..INTEL." */
+    0x44,0x53,0x44,0x54,0xDA,0x08,0x00,0x00,  /* 00000000    "DSDT...." */
+    0x01,0x26,0x49,0x4E,0x54,0x45,0x4C,0x00,  /* 00000008    ".&INTEL." */
     0x69,0x6E,0x74,0x2D,0x78,0x65,0x6E,0x00,  /* 00000010    "int-xen." */
     0xD6,0x07,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
     0x13,0x05,0x05,0x20,0x08,0x50,0x4D,0x42,  /* 00000020    "... .PMB" */
@@ -34,7 +34,7 @@ unsigned char AmlCode[] =
     0x12,0x08,0x04,0x0A,0x07,0x0A,0x07,0x00,  /* 00000098    "........" */
     0x00,0x08,0x50,0x49,0x43,0x44,0x00,0x14,  /* 000000A0    "..PICD.." */
     0x0C,0x5F,0x50,0x49,0x43,0x01,0x70,0x68,  /* 000000A8    "._PIC.ph" */
-    0x50,0x49,0x43,0x44,0x10,0x45,0x80,0x5F,  /* 000000B0    "PICD.E._" */
+    0x50,0x49,0x43,0x44,0x10,0x45,0x82,0x5F,  /* 000000B0    "PICD.E._" */
     0x53,0x42,0x5F,0x5B,0x82,0x49,0x04,0x4D,  /* 000000B8    "SB_[.I.M" */
     0x45,0x4D,0x30,0x08,0x5F,0x48,0x49,0x44,  /* 000000C0    "EM0._HID" */
     0x0C,0x41,0xD0,0x0C,0x02,0x08,0x5F,0x43,  /* 000000C8    ".A...._C" */
@@ -45,7 +45,7 @@ unsigned char AmlCode[] =
     0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F0    "........" */
     0x00,0x00,0x00,0x00,0x00,0x00,0x0A,0x00,  /* 000000F8    "........" */
     0x00,0x00,0x00,0x00,0x79,0x00,0x5B,0x82,  /* 00000100    "....y.[." */
-    0x42,0x7B,0x50,0x43,0x49,0x30,0x08,0x5F,  /* 00000108    "B{PCI0._" */
+    0x42,0x7D,0x50,0x43,0x49,0x30,0x08,0x5F,  /* 00000108    "B}PCI0._" */
     0x48,0x49,0x44,0x0C,0x41,0xD0,0x0A,0x03,  /* 00000110    "HID.A..." */
     0x08,0x5F,0x55,0x49,0x44,0x00,0x08,0x5F,  /* 00000118    "._UID.._" */
     0x41,0x44,0x52,0x00,0x08,0x5F,0x42,0x42,  /* 00000120    "ADR.._BB" */
@@ -55,9 +55,9 @@ unsigned char AmlCode[] =
     0x33,0x03,0x49,0x52,0x51,0x35,0x05,0x49,  /* 00000140    "3.IRQ5.I" */
     0x52,0x51,0x37,0x07,0x49,0x52,0x51,0x39,  /* 00000148    "RQ7.IRQ9" */
     0x09,0x49,0x52,0x51,0x41,0x0A,0x49,0x52,  /* 00000150    ".IRQA.IR" */
-    0x51,0x42,0x0B,0x14,0x44,0x08,0x5F,0x43,  /* 00000158    "QB..D._C" */
+    0x51,0x42,0x0B,0x14,0x4A,0x06,0x5F,0x43,  /* 00000158    "QB..J._C" */
     0x52,0x53,0x00,0x08,0x50,0x52,0x54,0x30,  /* 00000160    "RS..PRT0" */
-    0x11,0x42,0x07,0x0A,0x6E,0x88,0x0D,0x00,  /* 00000168    ".B..n..." */
+    0x11,0x48,0x05,0x0A,0x54,0x88,0x0D,0x00,  /* 00000168    ".H..T..." */
     0x02,0x0F,0x00,0x00,0x00,0x00,0x00,0xFF,  /* 00000170    "........" */
     0x00,0x00,0x00,0x00,0x01,0x47,0x01,0xF8,  /* 00000178    ".....G.." */
     0x0C,0xF8,0x0C,0x01,0x08,0x88,0x0D,0x00,  /* 00000180    "........" */
@@ -66,231 +66,235 @@ unsigned char AmlCode[] =
     0x01,0x0C,0x03,0x00,0x00,0x00,0x0D,0xFF,  /* 00000198    "........" */
     0xFF,0x00,0x00,0x00,0xF3,0x87,0x17,0x00,  /* 000001A0    "........" */
     0x00,0x0D,0x03,0x00,0x00,0x00,0x00,0x00,  /* 000001A8    "........" */
-    0x00,0x00,0xF0,0xFF,0xFF,0xFF,0xF1,0x00,  /* 000001B0    "........" */
-    0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x87,  /* 000001B8    "........" */
-    0x17,0x00,0x00,0x0D,0x03,0x00,0x00,0x00,  /* 000001C0    "........" */
-    0x00,0x00,0x00,0x00,0xF2,0xFF,0x0F,0x00,  /* 000001C8    "........" */
-    0xF2,0x00,0x00,0x00,0x00,0x00,0x10,0x00,  /* 000001D0    "........" */
-    0x00,0x79,0x00,0xA4,0x50,0x52,0x54,0x30,  /* 000001D8    ".y..PRT0" */
-    0x08,0x42,0x55,0x46,0x41,0x11,0x09,0x0A,  /* 000001E0    ".BUFA..." */
-    0x06,0x23,0xF8,0xDC,0x18,0x79,0x00,0x08,  /* 000001E8    ".#...y.." */
-    0x42,0x55,0x46,0x42,0x11,0x09,0x0A,0x06,  /* 000001F0    "BUFB...." */
-    0x23,0x00,0x00,0x18,0x79,0x00,0x8B,0x42,  /* 000001F8    "#...y..B" */
-    0x55,0x46,0x42,0x01,0x49,0x52,0x51,0x56,  /* 00000200    "UFB.IRQV" */
-    0x08,0x42,0x55,0x46,0x43,0x11,0x07,0x0A,  /* 00000208    ".BUFC..." */
-    0x04,0x05,0x07,0x0A,0x0B,0x8C,0x42,0x55,  /* 00000210    "......BU" */
-    0x46,0x43,0x01,0x50,0x49,0x51,0x41,0x8C,  /* 00000218    "FC.PIQA." */
-    0x42,0x55,0x46,0x43,0x01,0x50,0x49,0x51,  /* 00000220    "BUFC.PIQ" */
-    0x42,0x8C,0x42,0x55,0x46,0x43,0x01,0x50,  /* 00000228    "B.BUFC.P" */
-    0x49,0x51,0x43,0x8C,0x42,0x55,0x46,0x43,  /* 00000230    "IQC.BUFC" */
-    0x01,0x50,0x49,0x51,0x44,0x5B,0x82,0x48,  /* 00000238    ".PIQD[.H" */
-    0x08,0x4C,0x4E,0x4B,0x41,0x08,0x5F,0x48,  /* 00000240    ".LNKA._H" */
-    0x49,0x44,0x0C,0x41,0xD0,0x0C,0x0F,0x08,  /* 00000248    "ID.A...." */
-    0x5F,0x55,0x49,0x44,0x01,0x14,0x1C,0x5F,  /* 00000250    "_UID..._" */
-    0x53,0x54,0x41,0x00,0x7B,0x50,0x49,0x52,  /* 00000258    "STA.{PIR" */
-    0x41,0x0A,0x80,0x60,0xA0,0x08,0x93,0x60,  /* 00000260    "A..`...`" */
-    0x0A,0x80,0xA4,0x0A,0x09,0xA1,0x04,0xA4,  /* 00000268    "........" */
-    0x0A,0x0B,0x14,0x0B,0x5F,0x50,0x52,0x53,  /* 00000270    "...._PRS" */
-    0x00,0xA4,0x42,0x55,0x46,0x41,0x14,0x11,  /* 00000278    "..BUFA.." */
-    0x5F,0x44,0x49,0x53,0x00,0x7D,0x50,0x49,  /* 00000280    "_DIS.}PI" */
-    0x52,0x41,0x0A,0x80,0x50,0x49,0x52,0x41,  /* 00000288    "RA..PIRA" */
-    0x14,0x1A,0x5F,0x43,0x52,0x53,0x00,0x7B,  /* 00000290    ".._CRS.{" */
-    0x50,0x49,0x52,0x42,0x0A,0x0F,0x60,0x79,  /* 00000298    "PIRB..`y" */
-    0x01,0x60,0x49,0x52,0x51,0x56,0xA4,0x42,  /* 000002A0    ".`IRQV.B" */
-    0x55,0x46,0x42,0x14,0x1B,0x5F,0x53,0x52,  /* 000002A8    "UFB.._SR" */
-    0x53,0x01,0x8B,0x68,0x01,0x49,0x52,0x51,  /* 000002B0    "S..h.IRQ" */
-    0x31,0x82,0x49,0x52,0x51,0x31,0x60,0x76,  /* 000002B8    "1.IRQ1`v" */
-    0x60,0x70,0x60,0x50,0x49,0x52,0x41,0x5B,  /* 000002C0    "`p`PIRA[" */
-    0x82,0x49,0x08,0x4C,0x4E,0x4B,0x42,0x08,  /* 000002C8    ".I.LNKB." */
-    0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,0x0C,  /* 000002D0    "_HID.A.." */
-    0x0F,0x08,0x5F,0x55,0x49,0x44,0x0A,0x02,  /* 000002D8    ".._UID.." */
-    0x14,0x1C,0x5F,0x53,0x54,0x41,0x00,0x7B,  /* 000002E0    ".._STA.{" */
-    0x50,0x49,0x52,0x42,0x0A,0x80,0x60,0xA0,  /* 000002E8    "PIRB..`." */
-    0x08,0x93,0x60,0x0A,0x80,0xA4,0x0A,0x09,  /* 000002F0    "..`....." */
-    0xA1,0x04,0xA4,0x0A,0x0B,0x14,0x0B,0x5F,  /* 000002F8    "......._" */
-    0x50,0x52,0x53,0x00,0xA4,0x42,0x55,0x46,  /* 00000300    "PRS..BUF" */
-    0x41,0x14,0x11,0x5F,0x44,0x49,0x53,0x00,  /* 00000308    "A.._DIS." */
-    0x7D,0x50,0x49,0x52,0x42,0x0A,0x80,0x50,  /* 00000310    "}PIRB..P" */
-    0x49,0x52,0x42,0x14,0x1A,0x5F,0x43,0x52,  /* 00000318    "IRB.._CR" */
-    0x53,0x00,0x7B,0x50,0x49,0x52,0x42,0x0A,  /* 00000320    "S.{PIRB." */
-    0x0F,0x60,0x79,0x01,0x60,0x49,0x52,0x51,  /* 00000328    ".`y.`IRQ" */
-    0x56,0xA4,0x42,0x55,0x46,0x42,0x14,0x1B,  /* 00000330    "V.BUFB.." */
-    0x5F,0x53,0x52,0x53,0x01,0x8B,0x68,0x01,  /* 00000338    "_SRS..h." */
-    0x49,0x52,0x51,0x31,0x82,0x49,0x52,0x51,  /* 00000340    "IRQ1.IRQ" */
-    0x31,0x60,0x76,0x60,0x70,0x60,0x50,0x49,  /* 00000348    "1`v`p`PI" */
-    0x52,0x42,0x5B,0x82,0x49,0x08,0x4C,0x4E,  /* 00000350    "RB[.I.LN" */
-    0x4B,0x43,0x08,0x5F,0x48,0x49,0x44,0x0C,  /* 00000358    "KC._HID." */
-    0x41,0xD0,0x0C,0x0F,0x08,0x5F,0x55,0x49,  /* 00000360    "A...._UI" */
-    0x44,0x0A,0x03,0x14,0x1C,0x5F,0x53,0x54,  /* 00000368    "D...._ST" */
-    0x41,0x00,0x7B,0x50,0x49,0x52,0x43,0x0A,  /* 00000370    "A.{PIRC." */
-    0x80,0x60,0xA0,0x08,0x93,0x60,0x0A,0x80,  /* 00000378    ".`...`.." */
-    0xA4,0x0A,0x09,0xA1,0x04,0xA4,0x0A,0x0B,  /* 00000380    "........" */
-    0x14,0x0B,0x5F,0x50,0x52,0x53,0x00,0xA4,  /* 00000388    ".._PRS.." */
-    0x42,0x55,0x46,0x41,0x14,0x11,0x5F,0x44,  /* 00000390    "BUFA.._D" */
-    0x49,0x53,0x00,0x7D,0x50,0x49,0x52,0x43,  /* 00000398    "IS.}PIRC" */
-    0x0A,0x80,0x50,0x49,0x52,0x43,0x14,0x1A,  /* 000003A0    "..PIRC.." */
-    0x5F,0x43,0x52,0x53,0x00,0x7B,0x50,0x49,  /* 000003A8    "_CRS.{PI" */
-    0x52,0x43,0x0A,0x0F,0x60,0x79,0x01,0x60,  /* 000003B0    "RC..`y.`" */
-    0x49,0x52,0x51,0x56,0xA4,0x42,0x55,0x46,  /* 000003B8    "IRQV.BUF" */
-    0x42,0x14,0x1B,0x5F,0x53,0x52,0x53,0x01,  /* 000003C0    "B.._SRS." */
-    0x8B,0x68,0x01,0x49,0x52,0x51,0x31,0x82,  /* 000003C8    ".h.IRQ1." */
-    0x49,0x52,0x51,0x31,0x60,0x76,0x60,0x70,  /* 000003D0    "IRQ1`v`p" */
-    0x60,0x50,0x49,0x52,0x43,0x5B,0x82,0x49,  /* 000003D8    "`PIRC[.I" */
-    0x08,0x4C,0x4E,0x4B,0x44,0x08,0x5F,0x48,  /* 000003E0    ".LNKD._H" */
-    0x49,0x44,0x0C,0x41,0xD0,0x0C,0x0F,0x08,  /* 000003E8    "ID.A...." */
-    0x5F,0x55,0x49,0x44,0x0A,0x04,0x14,0x1C,  /* 000003F0    "_UID...." */
-    0x5F,0x53,0x54,0x41,0x00,0x7B,0x50,0x49,  /* 000003F8    "_STA.{PI" */
-    0x52,0x44,0x0A,0x80,0x60,0xA0,0x08,0x93,  /* 00000400    "RD..`..." */
-    0x60,0x0A,0x80,0xA4,0x0A,0x09,0xA1,0x04,  /* 00000408    "`......." */
-    0xA4,0x0A,0x0B,0x14,0x0B,0x5F,0x50,0x52,  /* 00000410    "....._PR" */
-    0x53,0x00,0xA4,0x42,0x55,0x46,0x41,0x14,  /* 00000418    "S..BUFA." */
-    0x11,0x5F,0x44,0x49,0x53,0x00,0x7D,0x50,  /* 00000420    "._DIS.}P" */
-    0x49,0x52,0x44,0x0A,0x80,0x50,0x49,0x52,  /* 00000428    "IRD..PIR" */
-    0x44,0x14,0x1A,0x5F,0x43,0x52,0x53,0x00,  /* 00000430    "D.._CRS." */
-    0x7B,0x50,0x49,0x52,0x44,0x0A,0x0F,0x60,  /* 00000438    "{PIRD..`" */
-    0x79,0x01,0x60,0x49,0x52,0x51,0x56,0xA4,  /* 00000440    "y.`IRQV." */
-    0x42,0x55,0x46,0x42,0x14,0x1B,0x5F,0x53,  /* 00000448    "BUFB.._S" */
-    0x52,0x53,0x01,0x8B,0x68,0x01,0x49,0x52,  /* 00000450    "RS..h.IR" */
-    0x51,0x31,0x82,0x49,0x52,0x51,0x31,0x60,  /* 00000458    "Q1.IRQ1`" */
-    0x76,0x60,0x70,0x60,0x50,0x49,0x52,0x44,  /* 00000460    "v`p`PIRD" */
-    0x14,0x16,0x5F,0x50,0x52,0x54,0x00,0xA0,  /* 00000468    ".._PRT.." */
-    0x0A,0x50,0x49,0x43,0x44,0xA4,0x50,0x52,  /* 00000470    ".PICD.PR" */
-    0x54,0x41,0xA4,0x50,0x52,0x54,0x50,0x08,  /* 00000478    "TA.PRTP." */
-    0x50,0x52,0x54,0x50,0x12,0x43,0x0E,0x10,  /* 00000480    "PRTP.C.." */
-    0x12,0x0B,0x04,0x0B,0xFF,0xFF,0x00,0x4C,  /* 00000488    ".......L" */
-    0x4E,0x4B,0x41,0x00,0x12,0x0B,0x04,0x0B,  /* 00000490    "NKA....." */
-    0xFF,0xFF,0x01,0x4C,0x4E,0x4B,0x42,0x00,  /* 00000498    "...LNKB." */
-    0x12,0x0C,0x04,0x0B,0xFF,0xFF,0x0A,0x02,  /* 000004A0    "........" */
-    0x4C,0x4E,0x4B,0x43,0x00,0x12,0x0C,0x04,  /* 000004A8    "LNKC...." */
-    0x0B,0xFF,0xFF,0x0A,0x03,0x4C,0x4E,0x4B,  /* 000004B0    ".....LNK" */
-    0x44,0x00,0x12,0x0D,0x04,0x0C,0xFF,0xFF,  /* 000004B8    "D......." */
-    0x01,0x00,0x00,0x4C,0x4E,0x4B,0x42,0x00,  /* 000004C0    "...LNKB." */
-    0x12,0x0D,0x04,0x0C,0xFF,0xFF,0x01,0x00,  /* 000004C8    "........" */
-    0x01,0x4C,0x4E,0x4B,0x43,0x00,0x12,0x0E,  /* 000004D0    ".LNKC..." */
-    0x04,0x0C,0xFF,0xFF,0x01,0x00,0x0A,0x02,  /* 000004D8    "........" */
-    0x4C,0x4E,0x4B,0x44,0x00,0x12,0x0E,0x04,  /* 000004E0    "LNKD...." */
-    0x0C,0xFF,0xFF,0x01,0x00,0x0A,0x03,0x4C,  /* 000004E8    ".......L" */
-    0x4E,0x4B,0x41,0x00,0x12,0x0D,0x04,0x0C,  /* 000004F0    "NKA....." */
-    0xFF,0xFF,0x02,0x00,0x00,0x4C,0x4E,0x4B,  /* 000004F8    ".....LNK" */
-    0x43,0x00,0x12,0x0D,0x04,0x0C,0xFF,0xFF,  /* 00000500    "C......." */
-    0x02,0x00,0x01,0x4C,0x4E,0x4B,0x44,0x00,  /* 00000508    "...LNKD." */
-    0x12,0x0E,0x04,0x0C,0xFF,0xFF,0x02,0x00,  /* 00000510    "........" */
-    0x0A,0x02,0x4C,0x4E,0x4B,0x41,0x00,0x12,  /* 00000518    "..LNKA.." */
-    0x0E,0x04,0x0C,0xFF,0xFF,0x02,0x00,0x0A,  /* 00000520    "........" */
-    0x03,0x4C,0x4E,0x4B,0x42,0x00,0x12,0x0D,  /* 00000528    ".LNKB..." */
-    0x04,0x0C,0xFF,0xFF,0x03,0x00,0x00,0x4C,  /* 00000530    ".......L" */
-    0x4E,0x4B,0x44,0x00,0x12,0x0D,0x04,0x0C,  /* 00000538    "NKD....." */
-    0xFF,0xFF,0x03,0x00,0x01,0x4C,0x4E,0x4B,  /* 00000540    ".....LNK" */
-    0x41,0x00,0x12,0x0E,0x04,0x0C,0xFF,0xFF,  /* 00000548    "A......." */
-    0x03,0x00,0x0A,0x02,0x4C,0x4E,0x4B,0x42,  /* 00000550    "....LNKB" */
-    0x00,0x12,0x0E,0x04,0x0C,0xFF,0xFF,0x03,  /* 00000558    "........" */
-    0x00,0x0A,0x03,0x4C,0x4E,0x4B,0x43,0x00,  /* 00000560    "...LNKC." */
-    0x08,0x50,0x52,0x54,0x41,0x12,0x32,0x04,  /* 00000568    ".PRTA.2." */
-    0x12,0x0B,0x04,0x0C,0xFF,0xFF,0x01,0x00,  /* 00000570    "........" */
-    0x00,0x00,0x0A,0x05,0x12,0x0B,0x04,0x0C,  /* 00000578    "........" */
-    0xFF,0xFF,0x02,0x00,0x00,0x00,0x0A,0x07,  /* 00000580    "........" */
-    0x12,0x0B,0x04,0x0C,0xFF,0xFF,0x03,0x00,  /* 00000588    "........" */
-    0x00,0x00,0x0A,0x0A,0x12,0x0B,0x04,0x0C,  /* 00000590    "........" */
-    0xFF,0xFF,0x04,0x00,0x00,0x00,0x0A,0x0B,  /* 00000598    "........" */
-    0x5B,0x82,0x48,0x31,0x49,0x53,0x41,0x5F,  /* 000005A0    "[.H1ISA_" */
-    0x08,0x5F,0x41,0x44,0x52,0x00,0x5B,0x80,  /* 000005A8    "._ADR.[." */
-    0x50,0x49,0x52,0x51,0x02,0x0A,0x60,0x0A,  /* 000005B0    "PIRQ..`." */
-    0x04,0x10,0x2E,0x5C,0x00,0x5B,0x81,0x29,  /* 000005B8    "...\.[.)" */
-    0x5C,0x2F,0x04,0x5F,0x53,0x42,0x5F,0x50,  /* 000005C0    "\/._SB_P" */
-    0x43,0x49,0x30,0x49,0x53,0x41,0x5F,0x50,  /* 000005C8    "CI0ISA_P" */
-    0x49,0x52,0x51,0x01,0x50,0x49,0x52,0x41,  /* 000005D0    "IRQ.PIRA" */
-    0x08,0x50,0x49,0x52,0x42,0x08,0x50,0x49,  /* 000005D8    ".PIRB.PI" */
-    0x52,0x43,0x08,0x50,0x49,0x52,0x44,0x08,  /* 000005E0    "RC.PIRD." */
-    0x5B,0x82,0x46,0x0B,0x53,0x59,0x53,0x52,  /* 000005E8    "[.F.SYSR" */
-    0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,  /* 000005F0    "._HID.A." */
-    0x0C,0x02,0x08,0x5F,0x55,0x49,0x44,0x01,  /* 000005F8    "..._UID." */
-    0x08,0x43,0x52,0x53,0x5F,0x11,0x4E,0x08,  /* 00000600    ".CRS_.N." */
-    0x0A,0x8A,0x47,0x01,0x10,0x00,0x10,0x00,  /* 00000608    "..G....." */
-    0x00,0x10,0x47,0x01,0x22,0x00,0x22,0x00,  /* 00000610    "..G."."." */
-    0x00,0x0C,0x47,0x01,0x30,0x00,0x30,0x00,  /* 00000618    "..G.0.0." */
-    0x00,0x10,0x47,0x01,0x44,0x00,0x44,0x00,  /* 00000620    "..G.D.D." */
-    0x00,0x1C,0x47,0x01,0x62,0x00,0x62,0x00,  /* 00000628    "..G.b.b." */
-    0x00,0x02,0x47,0x01,0x65,0x00,0x65,0x00,  /* 00000630    "..G.e.e." */
-    0x00,0x0B,0x47,0x01,0x72,0x00,0x72,0x00,  /* 00000638    "..G.r.r." */
-    0x00,0x0E,0x47,0x01,0x80,0x00,0x80,0x00,  /* 00000640    "..G....." */
-    0x00,0x01,0x47,0x01,0x84,0x00,0x84,0x00,  /* 00000648    "..G....." */
-    0x00,0x03,0x47,0x01,0x88,0x00,0x88,0x00,  /* 00000650    "..G....." */
-    0x00,0x01,0x47,0x01,0x8C,0x00,0x8C,0x00,  /* 00000658    "..G....." */
-    0x00,0x03,0x47,0x01,0x90,0x00,0x90,0x00,  /* 00000660    "..G....." */
-    0x00,0x10,0x47,0x01,0xA2,0x00,0xA2,0x00,  /* 00000668    "..G....." */
-    0x00,0x1C,0x47,0x01,0xE0,0x00,0xE0,0x00,  /* 00000670    "..G....." */
-    0x00,0x10,0x47,0x01,0xA0,0x08,0xA0,0x08,  /* 00000678    "..G....." */
-    0x00,0x04,0x47,0x01,0xC0,0x0C,0xC0,0x0C,  /* 00000680    "..G....." */
-    0x00,0x10,0x47,0x01,0xD0,0x04,0xD0,0x04,  /* 00000688    "..G....." */
-    0x00,0x02,0x79,0x00,0x14,0x0B,0x5F,0x43,  /* 00000690    "..y..._C" */
-    0x52,0x53,0x00,0xA4,0x43,0x52,0x53,0x5F,  /* 00000698    "RS..CRS_" */
-    0x5B,0x82,0x2B,0x50,0x49,0x43,0x5F,0x08,  /* 000006A0    "[.+PIC_." */
-    0x5F,0x48,0x49,0x44,0x0B,0x41,0xD0,0x08,  /* 000006A8    "_HID.A.." */
-    0x5F,0x43,0x52,0x53,0x11,0x18,0x0A,0x15,  /* 000006B0    "_CRS...." */
-    0x47,0x01,0x20,0x00,0x20,0x00,0x01,0x02,  /* 000006B8    "G. . ..." */
-    0x47,0x01,0xA0,0x00,0xA0,0x00,0x01,0x02,  /* 000006C0    "G......." */
-    0x22,0x04,0x00,0x79,0x00,0x5B,0x82,0x47,  /* 000006C8    ""..y.[.G" */
-    0x05,0x44,0x4D,0x41,0x30,0x08,0x5F,0x48,  /* 000006D0    ".DMA0._H" */
-    0x49,0x44,0x0C,0x41,0xD0,0x02,0x00,0x08,  /* 000006D8    "ID.A...." */
-    0x5F,0x43,0x52,0x53,0x11,0x41,0x04,0x0A,  /* 000006E0    "_CRS.A.." */
-    0x3D,0x2A,0x10,0x04,0x47,0x01,0x00,0x00,  /* 000006E8    "=*..G..." */
-    0x00,0x00,0x00,0x10,0x47,0x01,0x81,0x00,  /* 000006F0    "....G..." */
-    0x81,0x00,0x00,0x03,0x47,0x01,0x87,0x00,  /* 000006F8    "....G..." */
-    0x87,0x00,0x00,0x01,0x47,0x01,0x89,0x00,  /* 00000700    "....G..." */
-    0x89,0x00,0x00,0x03,0x47,0x01,0x8F,0x00,  /* 00000708    "....G..." */
-    0x8F,0x00,0x00,0x01,0x47,0x01,0xC0,0x00,  /* 00000710    "....G..." */
-    0xC0,0x00,0x00,0x20,0x47,0x01,0x80,0x04,  /* 00000718    "... G..." */
-    0x80,0x04,0x00,0x10,0x79,0x00,0x5B,0x82,  /* 00000720    "....y.[." */
-    0x25,0x54,0x4D,0x52,0x5F,0x08,0x5F,0x48,  /* 00000728    "%TMR_._H" */
-    0x49,0x44,0x0C,0x41,0xD0,0x01,0x00,0x08,  /* 00000730    "ID.A...." */
-    0x5F,0x43,0x52,0x53,0x11,0x10,0x0A,0x0D,  /* 00000738    "_CRS...." */
-    0x47,0x01,0x40,0x00,0x40,0x00,0x00,0x04,  /* 00000740    "G.@.@..." */
-    0x22,0x01,0x00,0x79,0x00,0x5B,0x82,0x25,  /* 00000748    ""..y.[.%" */
-    0x52,0x54,0x43,0x5F,0x08,0x5F,0x48,0x49,  /* 00000750    "RTC_._HI" */
-    0x44,0x0C,0x41,0xD0,0x0B,0x00,0x08,0x5F,  /* 00000758    "D.A...._" */
-    0x43,0x52,0x53,0x11,0x10,0x0A,0x0D,0x47,  /* 00000760    "CRS....G" */
-    0x01,0x70,0x00,0x70,0x00,0x00,0x02,0x22,  /* 00000768    ".p.p..."" */
-    0x00,0x01,0x79,0x00,0x5B,0x82,0x22,0x53,  /* 00000770    "..y.[."S" */
-    0x50,0x4B,0x52,0x08,0x5F,0x48,0x49,0x44,  /* 00000778    "PKR._HID" */
-    0x0C,0x41,0xD0,0x08,0x00,0x08,0x5F,0x43,  /* 00000780    ".A...._C" */
-    0x52,0x53,0x11,0x0D,0x0A,0x0A,0x47,0x01,  /* 00000788    "RS....G." */
-    0x61,0x00,0x61,0x00,0x00,0x01,0x79,0x00,  /* 00000790    "a.a...y." */
-    0x5B,0x82,0x31,0x50,0x53,0x32,0x4D,0x08,  /* 00000798    "[.1PS2M." */
-    0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,0x0F,  /* 000007A0    "_HID.A.." */
-    0x13,0x08,0x5F,0x43,0x49,0x44,0x0C,0x41,  /* 000007A8    ".._CID.A" */
-    0xD0,0x0F,0x13,0x14,0x09,0x5F,0x53,0x54,  /* 000007B0    "....._ST" */
-    0x41,0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,  /* 000007B8    "A....._C" */
-    0x52,0x53,0x11,0x08,0x0A,0x05,0x22,0x00,  /* 000007C0    "RS...."." */
-    0x10,0x79,0x00,0x5B,0x82,0x42,0x04,0x50,  /* 000007C8    ".y.[.B.P" */
-    0x53,0x32,0x4B,0x08,0x5F,0x48,0x49,0x44,  /* 000007D0    "S2K._HID" */
-    0x0C,0x41,0xD0,0x03,0x03,0x08,0x5F,0x43,  /* 000007D8    ".A...._C" */
-    0x49,0x44,0x0C,0x41,0xD0,0x03,0x0B,0x14,  /* 000007E0    "ID.A...." */
-    0x09,0x5F,0x53,0x54,0x41,0x00,0xA4,0x0A,  /* 000007E8    "._STA..." */
-    0x0F,0x08,0x5F,0x43,0x52,0x53,0x11,0x18,  /* 000007F0    ".._CRS.." */
-    0x0A,0x15,0x47,0x01,0x60,0x00,0x60,0x00,  /* 000007F8    "..G.`.`." */
-    0x00,0x01,0x47,0x01,0x64,0x00,0x64,0x00,  /* 00000800    "..G.d.d." */
-    0x00,0x01,0x22,0x02,0x00,0x79,0x00,0x5B,  /* 00000808    ".."..y.[" */
-    0x82,0x3A,0x46,0x44,0x43,0x30,0x08,0x5F,  /* 00000810    ".:FDC0._" */
-    0x48,0x49,0x44,0x0C,0x41,0xD0,0x07,0x00,  /* 00000818    "HID.A..." */
-    0x14,0x09,0x5F,0x53,0x54,0x41,0x00,0xA4,  /* 00000820    ".._STA.." */
-    0x0A,0x0F,0x08,0x5F,0x43,0x52,0x53,0x11,  /* 00000828    "..._CRS." */
-    0x1B,0x0A,0x18,0x47,0x01,0xF0,0x03,0xF0,  /* 00000830    "...G...." */
-    0x03,0x01,0x06,0x47,0x01,0xF7,0x03,0xF7,  /* 00000838    "...G...." */
-    0x03,0x01,0x01,0x22,0x40,0x00,0x2A,0x04,  /* 00000840    "..."@.*." */
-    0x00,0x79,0x00,0x5B,0x82,0x35,0x55,0x41,  /* 00000848    ".y.[.5UA" */
-    0x52,0x31,0x08,0x5F,0x48,0x49,0x44,0x0C,  /* 00000850    "R1._HID." */
-    0x41,0xD0,0x05,0x01,0x08,0x5F,0x55,0x49,  /* 00000858    "A...._UI" */
-    0x44,0x01,0x14,0x09,0x5F,0x53,0x54,0x41,  /* 00000860    "D..._STA" */
-    0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,0x52,  /* 00000868    "....._CR" */
-    0x53,0x11,0x10,0x0A,0x0D,0x47,0x01,0xF8,  /* 00000870    "S....G.." */
-    0x03,0xF8,0x03,0x01,0x08,0x22,0x10,0x00,  /* 00000878    ".....".." */
-    0x79,0x00,0x5B,0x82,0x36,0x4C,0x54,0x50,  /* 00000880    "y.[.6LTP" */
-    0x31,0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,  /* 00000888    "1._HID.A" */
-    0xD0,0x04,0x00,0x08,0x5F,0x55,0x49,0x44,  /* 00000890    "...._UID" */
-    0x0A,0x02,0x14,0x09,0x5F,0x53,0x54,0x41,  /* 00000898    "...._STA" */
-    0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,0x52,  /* 000008A0    "....._CR" */
-    0x53,0x11,0x10,0x0A,0x0D,0x47,0x01,0x78,  /* 000008A8    "S....G.x" */
-    0x03,0x78,0x03,0x08,0x08,0x22,0x80,0x00,  /* 000008B0    ".x...".." */
+    0x00,0x00,0xF0,0xFF,0xFF,0xFF,0xF4,0x00,  /* 000001B0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x05,0x79,  /* 000001B8    ".......y" */
+    0x00,0xA4,0x50,0x52,0x54,0x30,0x08,0x42,  /* 000001C0    "..PRT0.B" */
+    0x55,0x46,0x41,0x11,0x09,0x0A,0x06,0x23,  /* 000001C8    "UFA....#" */
+    0xF8,0xDC,0x18,0x79,0x00,0x08,0x42,0x55,  /* 000001D0    "...y..BU" */
+    0x46,0x42,0x11,0x09,0x0A,0x06,0x23,0x00,  /* 000001D8    "FB....#." */
+    0x00,0x18,0x79,0x00,0x8B,0x42,0x55,0x46,  /* 000001E0    "..y..BUF" */
+    0x42,0x01,0x49,0x52,0x51,0x56,0x08,0x42,  /* 000001E8    "B.IRQV.B" */
+    0x55,0x46,0x43,0x11,0x07,0x0A,0x04,0x05,  /* 000001F0    "UFC....." */
+    0x07,0x0A,0x0B,0x8C,0x42,0x55,0x46,0x43,  /* 000001F8    "....BUFC" */
+    0x01,0x50,0x49,0x51,0x41,0x8C,0x42,0x55,  /* 00000200    ".PIQA.BU" */
+    0x46,0x43,0x01,0x50,0x49,0x51,0x42,0x8C,  /* 00000208    "FC.PIQB." */
+    0x42,0x55,0x46,0x43,0x01,0x50,0x49,0x51,  /* 00000210    "BUFC.PIQ" */
+    0x43,0x8C,0x42,0x55,0x46,0x43,0x01,0x50,  /* 00000218    "C.BUFC.P" */
+    0x49,0x51,0x44,0x5B,0x82,0x48,0x08,0x4C,  /* 00000220    "IQD[.H.L" */
+    0x4E,0x4B,0x41,0x08,0x5F,0x48,0x49,0x44,  /* 00000228    "NKA._HID" */
+    0x0C,0x41,0xD0,0x0C,0x0F,0x08,0x5F,0x55,  /* 00000230    ".A...._U" */
+    0x49,0x44,0x01,0x14,0x1C,0x5F,0x53,0x54,  /* 00000238    "ID..._ST" */
+    0x41,0x00,0x7B,0x50,0x49,0x52,0x41,0x0A,  /* 00000240    "A.{PIRA." */
+    0x80,0x60,0xA0,0x08,0x93,0x60,0x0A,0x80,  /* 00000248    ".`...`.." */
+    0xA4,0x0A,0x09,0xA1,0x04,0xA4,0x0A,0x0B,  /* 00000250    "........" */
+    0x14,0x0B,0x5F,0x50,0x52,0x53,0x00,0xA4,  /* 00000258    ".._PRS.." */
+    0x42,0x55,0x46,0x41,0x14,0x11,0x5F,0x44,  /* 00000260    "BUFA.._D" */
+    0x49,0x53,0x00,0x7D,0x50,0x49,0x52,0x41,  /* 00000268    "IS.}PIRA" */
+    0x0A,0x80,0x50,0x49,0x52,0x41,0x14,0x1A,  /* 00000270    "..PIRA.." */
+    0x5F,0x43,0x52,0x53,0x00,0x7B,0x50,0x49,  /* 00000278    "_CRS.{PI" */
+    0x52,0x42,0x0A,0x0F,0x60,0x79,0x01,0x60,  /* 00000280    "RB..`y.`" */
+    0x49,0x52,0x51,0x56,0xA4,0x42,0x55,0x46,  /* 00000288    "IRQV.BUF" */
+    0x42,0x14,0x1B,0x5F,0x53,0x52,0x53,0x01,  /* 00000290    "B.._SRS." */
+    0x8B,0x68,0x01,0x49,0x52,0x51,0x31,0x82,  /* 00000298    ".h.IRQ1." */
+    0x49,0x52,0x51,0x31,0x60,0x76,0x60,0x70,  /* 000002A0    "IRQ1`v`p" */
+    0x60,0x50,0x49,0x52,0x41,0x5B,0x82,0x49,  /* 000002A8    "`PIRA[.I" */
+    0x08,0x4C,0x4E,0x4B,0x42,0x08,0x5F,0x48,  /* 000002B0    ".LNKB._H" */
+    0x49,0x44,0x0C,0x41,0xD0,0x0C,0x0F,0x08,  /* 000002B8    "ID.A...." */
+    0x5F,0x55,0x49,0x44,0x0A,0x02,0x14,0x1C,  /* 000002C0    "_UID...." */
+    0x5F,0x53,0x54,0x41,0x00,0x7B,0x50,0x49,  /* 000002C8    "_STA.{PI" */
+    0x52,0x42,0x0A,0x80,0x60,0xA0,0x08,0x93,  /* 000002D0    "RB..`..." */
+    0x60,0x0A,0x80,0xA4,0x0A,0x09,0xA1,0x04,  /* 000002D8    "`......." */
+    0xA4,0x0A,0x0B,0x14,0x0B,0x5F,0x50,0x52,  /* 000002E0    "....._PR" */
+    0x53,0x00,0xA4,0x42,0x55,0x46,0x41,0x14,  /* 000002E8    "S..BUFA." */
+    0x11,0x5F,0x44,0x49,0x53,0x00,0x7D,0x50,  /* 000002F0    "._DIS.}P" */
+    0x49,0x52,0x42,0x0A,0x80,0x50,0x49,0x52,  /* 000002F8    "IRB..PIR" */
+    0x42,0x14,0x1A,0x5F,0x43,0x52,0x53,0x00,  /* 00000300    "B.._CRS." */
+    0x7B,0x50,0x49,0x52,0x42,0x0A,0x0F,0x60,  /* 00000308    "{PIRB..`" */
+    0x79,0x01,0x60,0x49,0x52,0x51,0x56,0xA4,  /* 00000310    "y.`IRQV." */
+    0x42,0x55,0x46,0x42,0x14,0x1B,0x5F,0x53,  /* 00000318    "BUFB.._S" */
+    0x52,0x53,0x01,0x8B,0x68,0x01,0x49,0x52,  /* 00000320    "RS..h.IR" */
+    0x51,0x31,0x82,0x49,0x52,0x51,0x31,0x60,  /* 00000328    "Q1.IRQ1`" */
+    0x76,0x60,0x70,0x60,0x50,0x49,0x52,0x42,  /* 00000330    "v`p`PIRB" */
+    0x5B,0x82,0x49,0x08,0x4C,0x4E,0x4B,0x43,  /* 00000338    "[.I.LNKC" */
+    0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,  /* 00000340    "._HID.A." */
+    0x0C,0x0F,0x08,0x5F,0x55,0x49,0x44,0x0A,  /* 00000348    "..._UID." */
+    0x03,0x14,0x1C,0x5F,0x53,0x54,0x41,0x00,  /* 00000350    "..._STA." */
+    0x7B,0x50,0x49,0x52,0x43,0x0A,0x80,0x60,  /* 00000358    "{PIRC..`" */
+    0xA0,0x08,0x93,0x60,0x0A,0x80,0xA4,0x0A,  /* 00000360    "...`...." */
+    0x09,0xA1,0x04,0xA4,0x0A,0x0B,0x14,0x0B,  /* 00000368    "........" */
+    0x5F,0x50,0x52,0x53,0x00,0xA4,0x42,0x55,  /* 00000370    "_PRS..BU" */
+    0x46,0x41,0x14,0x11,0x5F,0x44,0x49,0x53,  /* 00000378    "FA.._DIS" */
+    0x00,0x7D,0x50,0x49,0x52,0x43,0x0A,0x80,  /* 00000380    ".}PIRC.." */
+    0x50,0x49,0x52,0x43,0x14,0x1A,0x5F,0x43,  /* 00000388    "PIRC.._C" */
+    0x52,0x53,0x00,0x7B,0x50,0x49,0x52,0x43,  /* 00000390    "RS.{PIRC" */
+    0x0A,0x0F,0x60,0x79,0x01,0x60,0x49,0x52,  /* 00000398    "..`y.`IR" */
+    0x51,0x56,0xA4,0x42,0x55,0x46,0x42,0x14,  /* 000003A0    "QV.BUFB." */
+    0x1B,0x5F,0x53,0x52,0x53,0x01,0x8B,0x68,  /* 000003A8    "._SRS..h" */
+    0x01,0x49,0x52,0x51,0x31,0x82,0x49,0x52,  /* 000003B0    ".IRQ1.IR" */
+    0x51,0x31,0x60,0x76,0x60,0x70,0x60,0x50,  /* 000003B8    "Q1`v`p`P" */
+    0x49,0x52,0x43,0x5B,0x82,0x49,0x08,0x4C,  /* 000003C0    "IRC[.I.L" */
+    0x4E,0x4B,0x44,0x08,0x5F,0x48,0x49,0x44,  /* 000003C8    "NKD._HID" */
+    0x0C,0x41,0xD0,0x0C,0x0F,0x08,0x5F,0x55,  /* 000003D0    ".A...._U" */
+    0x49,0x44,0x0A,0x04,0x14,0x1C,0x5F,0x53,  /* 000003D8    "ID...._S" */
+    0x54,0x41,0x00,0x7B,0x50,0x49,0x52,0x44,  /* 000003E0    "TA.{PIRD" */
+    0x0A,0x80,0x60,0xA0,0x08,0x93,0x60,0x0A,  /* 000003E8    "..`...`." */
+    0x80,0xA4,0x0A,0x09,0xA1,0x04,0xA4,0x0A,  /* 000003F0    "........" */
+    0x0B,0x14,0x0B,0x5F,0x50,0x52,0x53,0x00,  /* 000003F8    "..._PRS." */
+    0xA4,0x42,0x55,0x46,0x41,0x14,0x11,0x5F,  /* 00000400    ".BUFA.._" */
+    0x44,0x49,0x53,0x00,0x7D,0x50,0x49,0x52,  /* 00000408    "DIS.}PIR" */
+    0x44,0x0A,0x80,0x50,0x49,0x52,0x44,0x14,  /* 00000410    "D..PIRD." */
+    0x1A,0x5F,0x43,0x52,0x53,0x00,0x7B,0x50,  /* 00000418    "._CRS.{P" */
+    0x49,0x52,0x44,0x0A,0x0F,0x60,0x79,0x01,  /* 00000420    "IRD..`y." */
+    0x60,0x49,0x52,0x51,0x56,0xA4,0x42,0x55,  /* 00000428    "`IRQV.BU" */
+    0x46,0x42,0x14,0x1B,0x5F,0x53,0x52,0x53,  /* 00000430    "FB.._SRS" */
+    0x01,0x8B,0x68,0x01,0x49,0x52,0x51,0x31,  /* 00000438    "..h.IRQ1" */
+    0x82,0x49,0x52,0x51,0x31,0x60,0x76,0x60,  /* 00000440    ".IRQ1`v`" */
+    0x70,0x60,0x50,0x49,0x52,0x44,0x14,0x16,  /* 00000448    "p`PIRD.." */
+    0x5F,0x50,0x52,0x54,0x00,0xA0,0x0A,0x50,  /* 00000450    "_PRT...P" */
+    0x49,0x43,0x44,0xA4,0x50,0x52,0x54,0x41,  /* 00000458    "ICD.PRTA" */
+    0xA4,0x50,0x52,0x54,0x50,0x08,0x50,0x52,  /* 00000460    ".PRTP.PR" */
+    0x54,0x50,0x12,0x4D,0x11,0x14,0x12,0x0B,  /* 00000468    "TP.M...." */
+    0x04,0x0B,0xFF,0xFF,0x00,0x4C,0x4E,0x4B,  /* 00000470    ".....LNK" */
+    0x41,0x00,0x12,0x0B,0x04,0x0B,0xFF,0xFF,  /* 00000478    "A......." */
+    0x01,0x4C,0x4E,0x4B,0x42,0x00,0x12,0x0C,  /* 00000480    ".LNKB..." */
+    0x04,0x0B,0xFF,0xFF,0x0A,0x02,0x4C,0x4E,  /* 00000488    "......LN" */
+    0x4B,0x43,0x00,0x12,0x0C,0x04,0x0B,0xFF,  /* 00000490    "KC......" */
+    0xFF,0x0A,0x03,0x4C,0x4E,0x4B,0x44,0x00,  /* 00000498    "...LNKD." */
+    0x12,0x0D,0x04,0x0C,0xFF,0xFF,0x01,0x00,  /* 000004A0    "........" */
+    0x00,0x4C,0x4E,0x4B,0x42,0x00,0x12,0x0D,  /* 000004A8    ".LNKB..." */
+    0x04,0x0C,0xFF,0xFF,0x01,0x00,0x01,0x4C,  /* 000004B0    ".......L" */
+    0x4E,0x4B,0x43,0x00,0x12,0x0E,0x04,0x0C,  /* 000004B8    "NKC....." */
+    0xFF,0xFF,0x01,0x00,0x0A,0x02,0x4C,0x4E,  /* 000004C0    "......LN" */
+    0x4B,0x44,0x00,0x12,0x0E,0x04,0x0C,0xFF,  /* 000004C8    "KD......" */
+    0xFF,0x01,0x00,0x0A,0x03,0x4C,0x4E,0x4B,  /* 000004D0    ".....LNK" */
+    0x41,0x00,0x12,0x0D,0x04,0x0C,0xFF,0xFF,  /* 000004D8    "A......." */
+    0x02,0x00,0x00,0x4C,0x4E,0x4B,0x43,0x00,  /* 000004E0    "...LNKC." */
+    0x12,0x0D,0x04,0x0C,0xFF,0xFF,0x02,0x00,  /* 000004E8    "........" */
+    0x01,0x4C,0x4E,0x4B,0x44,0x00,0x12,0x0E,  /* 000004F0    ".LNKD..." */
+    0x04,0x0C,0xFF,0xFF,0x02,0x00,0x0A,0x02,  /* 000004F8    "........" */
+    0x4C,0x4E,0x4B,0x41,0x00,0x12,0x0E,0x04,  /* 00000500    "LNKA...." */
+    0x0C,0xFF,0xFF,0x02,0x00,0x0A,0x03,0x4C,  /* 00000508    ".......L" */
+    0x4E,0x4B,0x42,0x00,0x12,0x0D,0x04,0x0C,  /* 00000510    "NKB....." */
+    0xFF,0xFF,0x03,0x00,0x00,0x4C,0x4E,0x4B,  /* 00000518    ".....LNK" */
+    0x44,0x00,0x12,0x0D,0x04,0x0C,0xFF,0xFF,  /* 00000520    "D......." */
+    0x03,0x00,0x01,0x4C,0x4E,0x4B,0x41,0x00,  /* 00000528    "...LNKA." */
+    0x12,0x0E,0x04,0x0C,0xFF,0xFF,0x03,0x00,  /* 00000530    "........" */
+    0x0A,0x02,0x4C,0x4E,0x4B,0x42,0x00,0x12,  /* 00000538    "..LNKB.." */
+    0x0E,0x04,0x0C,0xFF,0xFF,0x03,0x00,0x0A,  /* 00000540    "........" */
+    0x03,0x4C,0x4E,0x4B,0x43,0x00,0x12,0x0D,  /* 00000548    ".LNKC..." */
+    0x04,0x0C,0xFF,0xFF,0x04,0x00,0x00,0x4C,  /* 00000550    ".......L" */
+    0x4E,0x4B,0x41,0x00,0x12,0x0D,0x04,0x0C,  /* 00000558    "NKA....." */
+    0xFF,0xFF,0x04,0x00,0x01,0x4C,0x4E,0x4B,  /* 00000560    ".....LNK" */
+    0x42,0x00,0x12,0x0E,0x04,0x0C,0xFF,0xFF,  /* 00000568    "B......." */
+    0x04,0x00,0x0A,0x02,0x4C,0x4E,0x4B,0x43,  /* 00000570    "....LNKC" */
+    0x00,0x12,0x0E,0x04,0x0C,0xFF,0xFF,0x04,  /* 00000578    "........" */
+    0x00,0x0A,0x03,0x4C,0x4E,0x4B,0x44,0x00,  /* 00000580    "...LNKD." */
+    0x08,0x50,0x52,0x54,0x41,0x12,0x32,0x04,  /* 00000588    ".PRTA.2." */
+    0x12,0x0B,0x04,0x0C,0xFF,0xFF,0x01,0x00,  /* 00000590    "........" */
+    0x00,0x00,0x0A,0x05,0x12,0x0B,0x04,0x0C,  /* 00000598    "........" */
+    0xFF,0xFF,0x02,0x00,0x00,0x00,0x0A,0x07,  /* 000005A0    "........" */
+    0x12,0x0B,0x04,0x0C,0xFF,0xFF,0x03,0x00,  /* 000005A8    "........" */
+    0x00,0x00,0x0A,0x0A,0x12,0x0B,0x04,0x0C,  /* 000005B0    "........" */
+    0xFF,0xFF,0x04,0x00,0x00,0x00,0x0A,0x0B,  /* 000005B8    "........" */
+    0x5B,0x82,0x48,0x31,0x49,0x53,0x41,0x5F,  /* 000005C0    "[.H1ISA_" */
+    0x08,0x5F,0x41,0x44,0x52,0x00,0x5B,0x80,  /* 000005C8    "._ADR.[." */
+    0x50,0x49,0x52,0x51,0x02,0x0A,0x60,0x0A,  /* 000005D0    "PIRQ..`." */
+    0x04,0x10,0x2E,0x5C,0x00,0x5B,0x81,0x29,  /* 000005D8    "...\.[.)" */
+    0x5C,0x2F,0x04,0x5F,0x53,0x42,0x5F,0x50,  /* 000005E0    "\/._SB_P" */
+    0x43,0x49,0x30,0x49,0x53,0x41,0x5F,0x50,  /* 000005E8    "CI0ISA_P" */
+    0x49,0x52,0x51,0x01,0x50,0x49,0x52,0x41,  /* 000005F0    "IRQ.PIRA" */
+    0x08,0x50,0x49,0x52,0x42,0x08,0x50,0x49,  /* 000005F8    ".PIRB.PI" */
+    0x52,0x43,0x08,0x50,0x49,0x52,0x44,0x08,  /* 00000600    "RC.PIRD." */
+    0x5B,0x82,0x46,0x0B,0x53,0x59,0x53,0x52,  /* 00000608    "[.F.SYSR" */
+    0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,  /* 00000610    "._HID.A." */
+    0x0C,0x02,0x08,0x5F,0x55,0x49,0x44,0x01,  /* 00000618    "..._UID." */
+    0x08,0x43,0x52,0x53,0x5F,0x11,0x4E,0x08,  /* 00000620    ".CRS_.N." */
+    0x0A,0x8A,0x47,0x01,0x10,0x00,0x10,0x00,  /* 00000628    "..G....." */
+    0x00,0x10,0x47,0x01,0x22,0x00,0x22,0x00,  /* 00000630    "..G."."." */
+    0x00,0x0C,0x47,0x01,0x30,0x00,0x30,0x00,  /* 00000638    "..G.0.0." */
+    0x00,0x10,0x47,0x01,0x44,0x00,0x44,0x00,  /* 00000640    "..G.D.D." */
+    0x00,0x1C,0x47,0x01,0x62,0x00,0x62,0x00,  /* 00000648    "..G.b.b." */
+    0x00,0x02,0x47,0x01,0x65,0x00,0x65,0x00,  /* 00000650    "..G.e.e." */
+    0x00,0x0B,0x47,0x01,0x72,0x00,0x72,0x00,  /* 00000658    "..G.r.r." */
+    0x00,0x0E,0x47,0x01,0x80,0x00,0x80,0x00,  /* 00000660    "..G....." */
+    0x00,0x01,0x47,0x01,0x84,0x00,0x84,0x00,  /* 00000668    "..G....." */
+    0x00,0x03,0x47,0x01,0x88,0x00,0x88,0x00,  /* 00000670    "..G....." */
+    0x00,0x01,0x47,0x01,0x8C,0x00,0x8C,0x00,  /* 00000678    "..G....." */
+    0x00,0x03,0x47,0x01,0x90,0x00,0x90,0x00,  /* 00000680    "..G....." */
+    0x00,0x10,0x47,0x01,0xA2,0x00,0xA2,0x00,  /* 00000688    "..G....." */
+    0x00,0x1C,0x47,0x01,0xE0,0x00,0xE0,0x00,  /* 00000690    "..G....." */
+    0x00,0x10,0x47,0x01,0xA0,0x08,0xA0,0x08,  /* 00000698    "..G....." */
+    0x00,0x04,0x47,0x01,0xC0,0x0C,0xC0,0x0C,  /* 000006A0    "..G....." */
+    0x00,0x10,0x47,0x01,0xD0,0x04,0xD0,0x04,  /* 000006A8    "..G....." */
+    0x00,0x02,0x79,0x00,0x14,0x0B,0x5F,0x43,  /* 000006B0    "..y..._C" */
+    0x52,0x53,0x00,0xA4,0x43,0x52,0x53,0x5F,  /* 000006B8    "RS..CRS_" */
+    0x5B,0x82,0x2B,0x50,0x49,0x43,0x5F,0x08,  /* 000006C0    "[.+PIC_." */
+    0x5F,0x48,0x49,0x44,0x0B,0x41,0xD0,0x08,  /* 000006C8    "_HID.A.." */
+    0x5F,0x43,0x52,0x53,0x11,0x18,0x0A,0x15,  /* 000006D0    "_CRS...." */
+    0x47,0x01,0x20,0x00,0x20,0x00,0x01,0x02,  /* 000006D8    "G. . ..." */
+    0x47,0x01,0xA0,0x00,0xA0,0x00,0x01,0x02,  /* 000006E0    "G......." */
+    0x22,0x04,0x00,0x79,0x00,0x5B,0x82,0x47,  /* 000006E8    ""..y.[.G" */
+    0x05,0x44,0x4D,0x41,0x30,0x08,0x5F,0x48,  /* 000006F0    ".DMA0._H" */
+    0x49,0x44,0x0C,0x41,0xD0,0x02,0x00,0x08,  /* 000006F8    "ID.A...." */
+    0x5F,0x43,0x52,0x53,0x11,0x41,0x04,0x0A,  /* 00000700    "_CRS.A.." */
+    0x3D,0x2A,0x10,0x04,0x47,0x01,0x00,0x00,  /* 00000708    "=*..G..." */
+    0x00,0x00,0x00,0x10,0x47,0x01,0x81,0x00,  /* 00000710    "....G..." */
+    0x81,0x00,0x00,0x03,0x47,0x01,0x87,0x00,  /* 00000718    "....G..." */
+    0x87,0x00,0x00,0x01,0x47,0x01,0x89,0x00,  /* 00000720    "....G..." */
+    0x89,0x00,0x00,0x03,0x47,0x01,0x8F,0x00,  /* 00000728    "....G..." */
+    0x8F,0x00,0x00,0x01,0x47,0x01,0xC0,0x00,  /* 00000730    "....G..." */
+    0xC0,0x00,0x00,0x20,0x47,0x01,0x80,0x04,  /* 00000738    "... G..." */
+    0x80,0x04,0x00,0x10,0x79,0x00,0x5B,0x82,  /* 00000740    "....y.[." */
+    0x25,0x54,0x4D,0x52,0x5F,0x08,0x5F,0x48,  /* 00000748    "%TMR_._H" */
+    0x49,0x44,0x0C,0x41,0xD0,0x01,0x00,0x08,  /* 00000750    "ID.A...." */
+    0x5F,0x43,0x52,0x53,0x11,0x10,0x0A,0x0D,  /* 00000758    "_CRS...." */
+    0x47,0x01,0x40,0x00,0x40,0x00,0x00,0x04,  /* 00000760    "G.@.@..." */
+    0x22,0x01,0x00,0x79,0x00,0x5B,0x82,0x25,  /* 00000768    ""..y.[.%" */
+    0x52,0x54,0x43,0x5F,0x08,0x5F,0x48,0x49,  /* 00000770    "RTC_._HI" */
+    0x44,0x0C,0x41,0xD0,0x0B,0x00,0x08,0x5F,  /* 00000778    "D.A...._" */
+    0x43,0x52,0x53,0x11,0x10,0x0A,0x0D,0x47,  /* 00000780    "CRS....G" */
+    0x01,0x70,0x00,0x70,0x00,0x00,0x02,0x22,  /* 00000788    ".p.p..."" */
+    0x00,0x01,0x79,0x00,0x5B,0x82,0x22,0x53,  /* 00000790    "..y.[."S" */
+    0x50,0x4B,0x52,0x08,0x5F,0x48,0x49,0x44,  /* 00000798    "PKR._HID" */
+    0x0C,0x41,0xD0,0x08,0x00,0x08,0x5F,0x43,  /* 000007A0    ".A...._C" */
+    0x52,0x53,0x11,0x0D,0x0A,0x0A,0x47,0x01,  /* 000007A8    "RS....G." */
+    0x61,0x00,0x61,0x00,0x00,0x01,0x79,0x00,  /* 000007B0    "a.a...y." */
+    0x5B,0x82,0x31,0x50,0x53,0x32,0x4D,0x08,  /* 000007B8    "[.1PS2M." */
+    0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,0x0F,  /* 000007C0    "_HID.A.." */
+    0x13,0x08,0x5F,0x43,0x49,0x44,0x0C,0x41,  /* 000007C8    ".._CID.A" */
+    0xD0,0x0F,0x13,0x14,0x09,0x5F,0x53,0x54,  /* 000007D0    "....._ST" */
+    0x41,0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,  /* 000007D8    "A....._C" */
+    0x52,0x53,0x11,0x08,0x0A,0x05,0x22,0x00,  /* 000007E0    "RS...."." */
+    0x10,0x79,0x00,0x5B,0x82,0x42,0x04,0x50,  /* 000007E8    ".y.[.B.P" */
+    0x53,0x32,0x4B,0x08,0x5F,0x48,0x49,0x44,  /* 000007F0    "S2K._HID" */
+    0x0C,0x41,0xD0,0x03,0x03,0x08,0x5F,0x43,  /* 000007F8    ".A...._C" */
+    0x49,0x44,0x0C,0x41,0xD0,0x03,0x0B,0x14,  /* 00000800    "ID.A...." */
+    0x09,0x5F,0x53,0x54,0x41,0x00,0xA4,0x0A,  /* 00000808    "._STA..." */
+    0x0F,0x08,0x5F,0x43,0x52,0x53,0x11,0x18,  /* 00000810    ".._CRS.." */
+    0x0A,0x15,0x47,0x01,0x60,0x00,0x60,0x00,  /* 00000818    "..G.`.`." */
+    0x00,0x01,0x47,0x01,0x64,0x00,0x64,0x00,  /* 00000820    "..G.d.d." */
+    0x00,0x01,0x22,0x02,0x00,0x79,0x00,0x5B,  /* 00000828    ".."..y.[" */
+    0x82,0x3A,0x46,0x44,0x43,0x30,0x08,0x5F,  /* 00000830    ".:FDC0._" */
+    0x48,0x49,0x44,0x0C,0x41,0xD0,0x07,0x00,  /* 00000838    "HID.A..." */
+    0x14,0x09,0x5F,0x53,0x54,0x41,0x00,0xA4,  /* 00000840    ".._STA.." */
+    0x0A,0x0F,0x08,0x5F,0x43,0x52,0x53,0x11,  /* 00000848    "..._CRS." */
+    0x1B,0x0A,0x18,0x47,0x01,0xF0,0x03,0xF0,  /* 00000850    "...G...." */
+    0x03,0x01,0x06,0x47,0x01,0xF7,0x03,0xF7,  /* 00000858    "...G...." */
+    0x03,0x01,0x01,0x22,0x40,0x00,0x2A,0x04,  /* 00000860    "..."@.*." */
+    0x00,0x79,0x00,0x5B,0x82,0x35,0x55,0x41,  /* 00000868    ".y.[.5UA" */
+    0x52,0x31,0x08,0x5F,0x48,0x49,0x44,0x0C,  /* 00000870    "R1._HID." */
+    0x41,0xD0,0x05,0x01,0x08,0x5F,0x55,0x49,  /* 00000878    "A...._UI" */
+    0x44,0x01,0x14,0x09,0x5F,0x53,0x54,0x41,  /* 00000880    "D..._STA" */
+    0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,0x52,  /* 00000888    "....._CR" */
+    0x53,0x11,0x10,0x0A,0x0D,0x47,0x01,0xF8,  /* 00000890    "S....G.." */
+    0x03,0xF8,0x03,0x01,0x08,0x22,0x10,0x00,  /* 00000898    ".....".." */
+    0x79,0x00,0x5B,0x82,0x36,0x4C,0x54,0x50,  /* 000008A0    "y.[.6LTP" */
+    0x31,0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,  /* 000008A8    "1._HID.A" */
+    0xD0,0x04,0x00,0x08,0x5F,0x55,0x49,0x44,  /* 000008B0    "...._UID" */
+    0x0A,0x02,0x14,0x09,0x5F,0x53,0x54,0x41,  /* 000008B8    "...._STA" */
+    0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,0x52,  /* 000008C0    "....._CR" */
+    0x53,0x11,0x10,0x0A,0x0D,0x47,0x01,0x78,  /* 000008C8    "S....G.x" */
+    0x03,0x78,0x03,0x08,0x08,0x22,0x80,0x00,  /* 000008D0    ".x...".." */
     0x79,0x00,
 };
 int DsdtLen=sizeof(AmlCode);
diff -r 5176c3ea3293 -r b725c9e51a7c tools/firmware/hvmloader/smbios.c
--- a/tools/firmware/hvmloader/smbios.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/firmware/hvmloader/smbios.c Sat Oct 14 13:28:45 2006 -0600
@@ -92,7 +92,6 @@ write_smbios_tables(void *start,
        unsigned cpu_num, nr_structs = 0, max_struct_size = 0;
        char *p, *q;
        char cpu_manufacturer[15];
-       size_t structure_table_length;
 
        get_cpu_manufacturer(cpu_manufacturer, 15);
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/ioemu/vl.c
--- a/tools/ioemu/vl.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/ioemu/vl.c  Sat Oct 14 13:28:45 2006 -0600
@@ -122,6 +122,7 @@ int nographic;
 int nographic;
 int vncviewer;
 int vncunused;
+struct sockaddr_in vnclisten_addr;
 const char* keyboard_layout = NULL;
 int64_t ticks_per_sec;
 char *boot_device = NULL;
@@ -2783,10 +2784,22 @@ fail:
     return -1;
 }
 
+int parse_host(struct sockaddr_in *saddr, const char *buf)
+{
+    struct hostent *he;
+
+    if ((he = gethostbyname(buf)) != NULL) {
+        saddr->sin_addr = *(struct in_addr *)he->h_addr;
+    } else {
+        if (!inet_aton(buf, &saddr->sin_addr))
+            return -1;
+    }
+    return 0;
+}
+
 int parse_host_port(struct sockaddr_in *saddr, const char *str)
 {
     char buf[512];
-    struct hostent *he;
     const char *p, *r;
     int port;
 
@@ -2797,14 +2810,8 @@ int parse_host_port(struct sockaddr_in *
     if (buf[0] == '\0') {
         saddr->sin_addr.s_addr = 0;
     } else {
-        if (isdigit(buf[0])) {
-            if (!inet_aton(buf, &saddr->sin_addr))
-                return -1;
-        } else {
-            if ((he = gethostbyname(buf)) == NULL)
-                return - 1;
-            saddr->sin_addr = *(struct in_addr *)he->h_addr;
-        }
+        if (parse_host(saddr, buf) == -1)
+            return -1;
     }
     port = strtol(p, (char **)&r, 0);
     if (r == p)
@@ -5352,6 +5359,7 @@ void help(void)
           "-vnc display    start a VNC server on display\n"
            "-vncviewer      start a vncviewer process for this domain\n"
            "-vncunused      bind the VNC server to an unused port\n"
+           "-vnclisten      bind the VNC server to this address\n"
            "-timeoffset     time offset (in seconds) from local time\n"
            "-acpi           disable or enable ACPI of HVM domain \n"
            "\n"
@@ -5444,6 +5452,7 @@ enum {
     QEMU_OPTION_acpi,
     QEMU_OPTION_vncviewer,
     QEMU_OPTION_vncunused,
+    QEMU_OPTION_vnclisten,
 };
 
 typedef struct QEMUOption {
@@ -5522,6 +5531,7 @@ const QEMUOption qemu_options[] = {
     { "vnc", HAS_ARG, QEMU_OPTION_vnc },
     { "vncviewer", 0, QEMU_OPTION_vncviewer },
     { "vncunused", 0, QEMU_OPTION_vncunused },
+    { "vnclisten", HAS_ARG, QEMU_OPTION_vnclisten },
     
     /* temporary options */
     { "usb", 0, QEMU_OPTION_usb },
@@ -5928,6 +5938,8 @@ int main(int argc, char **argv)
 
     nb_nics = 0;
     /* default mac address of the first network interface */
+
+    memset(&vnclisten_addr.sin_addr, 0, sizeof(vnclisten_addr.sin_addr));
     
     /* init debug */
     sprintf(qemu_dm_logfilename, "/var/log/xen/qemu-dm.%d.log", getpid());
@@ -6312,6 +6324,9 @@ int main(int argc, char **argv)
                 if (vnc_display == -1)
                     vnc_display = 0;
                 break;
+            case QEMU_OPTION_vnclisten:
+                parse_host(&vnclisten_addr, optarg);
+                break;
             }
         }
     }
@@ -6548,7 +6563,7 @@ int main(int argc, char **argv)
     if (nographic) {
         dumb_display_init(ds);
     } else if (vnc_display != -1) {
-       vnc_display = vnc_display_init(ds, vnc_display, vncunused);
+       vnc_display = vnc_display_init(ds, vnc_display, vncunused, 
&vnclisten_addr);
        if (vncviewer)
            vnc_start_viewer(vnc_display);
        xenstore_write_vncport(vnc_display);
diff -r 5176c3ea3293 -r b725c9e51a7c tools/ioemu/vl.h
--- a/tools/ioemu/vl.h  Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/ioemu/vl.h  Sat Oct 14 13:28:45 2006 -0600
@@ -37,6 +37,8 @@
 #include <unistd.h>
 #include <fcntl.h>
 #include <sys/stat.h>
+#include <sys/socket.h>
+#include <sys/types.h>
 #include "xenctrl.h"
 #include "xs.h"
 #include <xen/hvm/e820.h>
@@ -786,7 +788,7 @@ void cocoa_display_init(DisplayState *ds
 void cocoa_display_init(DisplayState *ds, int full_screen);
 
 /* vnc.c */
-int vnc_display_init(DisplayState *ds, int display, int find_unused);
+int vnc_display_init(DisplayState *ds, int display, int find_unused, struct 
sockaddr_in *addr);
 int vnc_start_viewer(int port);
 
 /* ide.c */
diff -r 5176c3ea3293 -r b725c9e51a7c tools/ioemu/vnc.c
--- a/tools/ioemu/vnc.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/ioemu/vnc.c Sat Oct 14 13:28:45 2006 -0600
@@ -1250,9 +1250,8 @@ static void vnc_listen_read(void *opaque
     }
 }
 
-int vnc_display_init(DisplayState *ds, int display, int find_unused)
-{
-    struct sockaddr_in addr;
+int vnc_display_init(DisplayState *ds, int display, int find_unused, struct 
sockaddr_in *addr)
+{
     int reuse_addr, ret;
     VncState *vs;
 
@@ -1290,11 +1289,10 @@ int vnc_display_init(DisplayState *ds, i
     }
 
  retry:
-    addr.sin_family = AF_INET;
-    addr.sin_port = htons(5900 + display);
-    memset(&addr.sin_addr, 0, sizeof(addr.sin_addr));
-
-    if (bind(vs->lsock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
+    addr->sin_family = AF_INET;
+    addr->sin_port = htons(5900 + display);
+
+    if (bind(vs->lsock, (struct sockaddr *)addr, sizeof(struct sockaddr_in)) 
== -1) {
        if (find_unused && errno == EADDRINUSE) {
            display++;
            goto retry;
diff -r 5176c3ea3293 -r b725c9e51a7c tools/libxc/xc_load_elf.c
--- a/tools/libxc/xc_load_elf.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/libxc/xc_load_elf.c Sat Oct 14 13:28:45 2006 -0600
@@ -364,7 +364,7 @@ static int parseelfimage(const char *ima
         if ( p != NULL && strncmp(p, "yes", 3) == 0 )
         {
             dsi->pae_kernel = PAEKERN_yes;
-            if ( !strncmp(p+4, "[extended-cr3]", 14) )
+            if ( !strncmp(p+3, "[extended-cr3]", 14) )
                 dsi->pae_kernel = PAEKERN_extended_cr3;
         }
     }
diff -r 5176c3ea3293 -r b725c9e51a7c tools/misc/mbootpack/Makefile
--- a/tools/misc/mbootpack/Makefile     Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/misc/mbootpack/Makefile     Sat Oct 14 13:28:45 2006 -0600
@@ -20,12 +20,8 @@ install: build
 
 #  Tools etc.
 RM     := rm -f
-GDB    := gdb
 INCS   := -I. -I-
 DEFS   := 
-LDFLAGS        := 
-CFLAGS += -Wpointer-arith -Wcast-qual -Wno-unused -Wno-format
-CFLAGS += -Wmissing-prototypes -pipe
 
 #  What object files need building for the program
 OBJS   := mbootpack.o buildimage.o
@@ -35,22 +31,22 @@ DEPS     = .*.d
 DEPS     = .*.d
 
 mbootpack: $(OBJS)
-       $(HOSTCC) -o $@ $(filter-out %.a, $^)
+       $(HOSTCC) $(HOSTCFLAGS) -o $@ $(filter-out %.a, $^)
 
 .PHONY: clean
 clean:
        $(RM) mbootpack *.o $(DEPS) bootsect setup bzimage_header.c bin2c
 
 bootsect: bootsect.S
-       $(CC) $(CFLAGS) $(INCS) $(DEFS) -D__MB_ASM -c bootsect.S -o bootsect.o
+       $(CC) -m32 $(INCS) $(DEFS) -D__MB_ASM -c bootsect.S -o bootsect.o
        $(LD) -m elf_i386 -Ttext 0x0 -s --oformat binary bootsect.o -o $@
 
 setup: setup.S
-       $(CC) $(CFLAGS) $(INCS) $(DEFS) -D__MB_ASM -c setup.S -o setup.o
+       $(CC) -m32 $(INCS) $(DEFS) -D__MB_ASM -c setup.S -o setup.o
        $(LD) -m elf_i386 -Ttext 0x0 -s --oformat binary setup.o -o $@
 
 bin2c: bin2c.o 
-       $(HOSTCC) -o $@ $^ 
+       $(HOSTCC) $(HOSTCFLAGS) -o $@ $^ 
 
 bzimage_header.c: bootsect setup bin2c
        ./bin2c -n 8 -b1 -a bzimage_bootsect bootsect > bzimage_header.c
@@ -59,11 +55,8 @@ buildimage.c: bzimage_header.c
 buildimage.c: bzimage_header.c
        @
 
-%.o: %.S
-       $(HOSTCC) $(DEPFLAGS) $(CFLAGS) $(INCS) $(DEFS) -c $< -o $@
-
 %.o: %.c
-       $(HOSTCC) $(DEPFLAGS) $(CFLAGS) $(INCS) $(DEFS) -c $< -o $@
+       $(HOSTCC) $(DEPFLAGS) $(HOSTCFLAGS) $(INCS) $(DEFS) -c $< -o $@
 
 .PRECIOUS: $(OBJS) $(OBJS:.o=.c) $(DEPS)
 .SUFFIXES: 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/misc/mbootpack/buildimage.c
--- a/tools/misc/mbootpack/buildimage.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/misc/mbootpack/buildimage.c Sat Oct 14 13:28:45 2006 -0600
@@ -24,8 +24,6 @@
  * $Id: buildimage.c,v 1.2 2005/03/23 10:39:19 tjd21 Exp $
  *
  */
-
-
 
 #include <assert.h>
 #include <stdio.h>
@@ -77,20 +75,22 @@
 /* Bring in the bzImage boot sector and setup code */
 #include "bzimage_header.c"
 
+#define _p(x) ((void *)(unsigned long)(x))
+
 address_t place_mbi(long int size) 
 /* Find space at the top of *low* memory for the MBI and associated red tape */
 {
     address_t start;
     start = 0xa000 - size;
     if (start < 0x9000 + sizeof(bzimage_bootsect) + sizeof(bzimage_setup)) {
-        printf("Fatal: command-lines too long: need %i, have %i bytes\n",
+        printf("Fatal: command-lines too long: need %ld, have %ld bytes\n",
                size, 
-               0x1000 - (sizeof(bzimage_bootsect) + sizeof(bzimage_setup)));
-        exit(1);        
+               0x1000L - (sizeof(bzimage_bootsect) + sizeof(bzimage_setup)));
+        exit(1);
     }
     if (!quiet) {
         printf("Placed MBI and strings (%p+%p)\n", 
-               start, size);
+               _p(start), _p(size));
     }
     return start;
 }
@@ -108,7 +108,7 @@ void make_bzImage(section_t *sections,
     /* Patch the kernel and mbi addresses into the setup code */
     *(address_t *)(bzimage_setup + BZ_ENTRY_OFFSET) = eswap(entry);
     *(address_t *)(bzimage_setup + BZ_MBI_OFFSET) = eswap(mbi);
-    if (!quiet) printf("Kernel entry is %p, MBI is %p.\n", entry, mbi);
+    if (!quiet) printf("Kernel entry is %p, MBI is %p.\n",_p(entry), _p(mbi));
 
     /* Write out header and trampoline */
     if (fseek(fp, 0, SEEK_SET) < 0) {
@@ -127,8 +127,9 @@ void make_bzImage(section_t *sections,
         exit(1);
     }
 
-    if (!quiet) printf("Wrote bzImage header: %i + %i bytes.\n", 
-                       sizeof(bzimage_bootsect), sizeof(bzimage_setup));
+    if (!quiet) printf("Wrote bzImage header: %ld + %ld bytes.\n", 
+                       (long)sizeof(bzimage_bootsect),
+                       (long)sizeof(bzimage_setup));
 
     /* Sorted list of sections below 1MB: write them out */
     for (s = sections, i = 0; s; s = s->next) {
diff -r 5176c3ea3293 -r b725c9e51a7c tools/misc/mbootpack/mbootpack.c
--- a/tools/misc/mbootpack/mbootpack.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/misc/mbootpack/mbootpack.c  Sat Oct 14 13:28:45 2006 -0600
@@ -128,6 +128,7 @@ static void usage(void)
     exit(1);
 }
 
+#define _p(x) ((void *)(unsigned long)(x))
 
 static void place_kernel_section(address_t start, long int size)
 /* Place the kernel in memory, checking for the memory hole. */
@@ -136,7 +137,8 @@ static void place_kernel_section(address
         /* Above the memory hole: easy */
         next_free_space = MAX(next_free_space, start + size);
         if (!quiet) {
-            printf("Placed kernel section (%p+%p)\n", start, size);
+            printf("Placed kernel section (%p+%p)\n",
+                   _p(start), _p(size));
         }
         return;
     }
@@ -144,14 +146,14 @@ static void place_kernel_section(address
     if (start >= MEM_HOLE_START) {
         /* In the memory hole.  Not so good */
         printf("Fatal: kernel load address (%p) is in the memory hole.\n",
-               start);
+               _p(start));
         exit(1);
     }
     
     if (start + size > MEM_HOLE_START) {
         /* Too big for low memory */
         printf("Fatal: kernel (%p+%p) runs into the memory hole.\n",
-               start, size);
+               _p(start), _p(size));
         exit(1);
     }  
     
@@ -159,7 +161,7 @@ static void place_kernel_section(address
     next_free_space = MAX(next_free_space, start + size);
 
     if (!quiet) {
-        printf("Placed kernel section (%p+%p)\n", start, size);
+        printf("Placed kernel section (%p+%p)\n", _p(start), _p(size));
     }
 }
 
@@ -182,12 +184,10 @@ static address_t place_section(long int 
 
     if (!quiet) {
         printf("Placed section (%p+%p), align=%p\n", 
-               start, size, align);
+               _p(start), _p(size), _p(align));
     }
     return start;
 }
-
-
 
 
 static address_t load_kernel(const char *filename)
@@ -296,7 +296,7 @@ static address_t load_kernel(const char 
                 size = loadsize;
             
             if (loadsize > size) {
-                printf("Fatal: can't load %i bytes of kernel into %i bytes " 
+                printf("Fatal: can't load %ld bytes of kernel into %ld bytes "
                        "of memory.\n", loadsize, size);
                 exit(1);
             }
@@ -466,8 +466,6 @@ static address_t load_kernel(const char 
 }
 
 
-
-
 int main(int argc, char **argv) 
 {
     char *buffer, *imagename, *command_line, *p;
@@ -480,7 +478,7 @@ int main(int argc, char **argv)
     struct mod_list *modp;
     address_t start, kernel_entry;
     long int size, mod_command_line_space, command_line_len;
-    int modules, opt, mbi_reloc_offset, make_multiboot;
+    int modules, opt, mbi_reloc_offset;
 
     static const char short_options[] = "hc:m:o:qM";
     static const struct option options[] = {
diff -r 5176c3ea3293 -r b725c9e51a7c tools/misc/miniterm/miniterm.c
--- a/tools/misc/miniterm/miniterm.c    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/misc/miniterm/miniterm.c    Sat Oct 14 13:28:45 2006 -0600
@@ -32,10 +32,11 @@
 #include <signal.h>
 #include <sys/types.h>
 #include <sys/wait.h>
+#include <string.h>
 
 #define DEFAULT_BAUDRATE   115200
 #define DEFAULT_SERDEVICE  "/dev/ttyS0"
-#define ENDMINITERM        2  /* ctrl-b to quit miniterm */
+#define ENDMINITERM        0x1d
 
 volatile int stop = 0;
 
@@ -76,7 +77,11 @@ int main(int argc, char **argv)
     char            *sername = DEFAULT_SERDEVICE;
     struct termios   oldsertio, newsertio, oldstdtio, newstdtio;
     struct sigaction sa;
- 
+    static char start_str[] = 
+        "************ REMOTE CONSOLE: CTRL-] TO QUIT ********\r\n";
+    static char end_str[] =
+        "\n************ REMOTE CONSOLE EXITED *****************\n";
+
     while ( --argc != 0 )
     {
         char *p = argv[argc];
@@ -121,7 +126,7 @@ int main(int argc, char **argv)
     newsertio.c_iflag = IGNBRK | IGNPAR;
 
     /* Raw output. */
-    newsertio.c_oflag = 0; 
+    newsertio.c_oflag = OPOST;
 
     /* No echo and no signals. */
     newsertio.c_lflag = 0;
@@ -137,7 +142,13 @@ int main(int argc, char **argv)
     /* next stop echo and buffering for stdin */
     tcgetattr(0,&oldstdtio);
     tcgetattr(0,&newstdtio); /* get working stdtio */
-    newstdtio.c_lflag &= ~(ICANON | ECHO);
+    newstdtio.c_iflag &= ~(BRKINT | ICRNL | INPCK | ISTRIP | IXON);
+    newstdtio.c_oflag &= ~OPOST;
+    newstdtio.c_cflag &= ~(CSIZE | PARENB);
+    newstdtio.c_cflag |= CS8;
+    newstdtio.c_lflag &= ~(ECHO | ICANON | IEXTEN | ISIG);
+    newstdtio.c_cc[VMIN]=1;
+    newstdtio.c_cc[VTIME]=0;
     tcsetattr(0,TCSANOW,&newstdtio);
 
     /* Terminal settings done: now enter the main I/O loops. */
@@ -145,7 +156,7 @@ int main(int argc, char **argv)
     {
     case 0:
         close(1); /* stdout not needed */
-        for ( c = getchar(); c != ENDMINITERM ; c = getchar() ) 
+        for ( c = (char)getchar(); c != ENDMINITERM; c = (char)getchar() )
             write(fd,&c,1);
         tcsetattr(fd,TCSANOW,&oldsertio);
         tcsetattr(0,TCSANOW,&oldstdtio);
@@ -158,7 +169,7 @@ int main(int argc, char **argv)
         close(fd);
         exit(-1);
     default:
-        printf("** ctrl-b quits miniterm **\n");
+        write(1, start_str, strlen(start_str));
         close(0); /* stdin not needed */
         sa.sa_handler = child_handler;
         sa.sa_flags = 0;
@@ -166,9 +177,11 @@ int main(int argc, char **argv)
         while ( !stop )
         {
             read(fd,&c,1); /* modem */
+            c = (char)c;
             write(1,&c,1); /* stdout */
         }
         wait(NULL); /* wait for child to die or it will become a zombie */
+        write(1, end_str, strlen(end_str));
         break;
     }
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/util/blkif.py
--- a/tools/python/xen/util/blkif.py    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/util/blkif.py    Sat Oct 14 13:28:45 2006 -0600
@@ -64,7 +64,7 @@ def blkdev_uname_to_file(uname):
     """Take a blkdev uname and return the corresponding filename."""
     fn = None
     if uname.find(":") != -1:
-        (typ, fn) = uname.split(":")
+        (typ, fn) = uname.split(":", 1)
         if typ == "phy" and not fn.startswith("/"):
             fn = "/dev/%s" %(fn,)
         if typ == "tap":
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xend/XendDomainInfo.py
--- a/tools/python/xen/xend/XendDomainInfo.py   Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xend/XendDomainInfo.py   Sat Oct 14 13:28:45 2006 -0600
@@ -1745,7 +1745,7 @@ class XendDomainInfo:
         blcfg = None
         # FIXME: this assumes that we want to use the first disk device
         for (n,c) in self.info['device']:
-            if not n or not c or n != "vbd":
+            if not n or not c or not(n in ["vbd", "tap"]):
                 continue
             disk = sxp.child_value(c, "uname")
             if disk is None:
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xend/XendRoot.py
--- a/tools/python/xen/xend/XendRoot.py Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xend/XendRoot.py Sat Oct 14 13:28:45 2006 -0600
@@ -95,6 +95,9 @@ class XendRoot:
     dom0_min_mem_default = '0'
 
     dom0_vcpus_default = '0'
+
+    """Default interface to listen for VNC connections on"""
+    xend_vnc_listen_default = '127.0.0.1'
 
     components = {}
 
@@ -272,6 +275,9 @@ class XendRoot:
     def get_console_limit(self):
         return self.get_config_int('console-limit', 1024)
 
+    def get_vnclisten_address(self):
+        return self.get_config_value('vnc-listen', 
self.xend_vnc_listen_default)
+
 def instance():
     """Get an instance of XendRoot.
     Use this instead of the constructor.
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xend/image.py
--- a/tools/python/xen/xend/image.py    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xend/image.py    Sat Oct 14 13:28:45 2006 -0600
@@ -361,6 +361,11 @@ class HVMImageHandler(ImageHandler):
             else:
                 ret += ['-vnc', '%d' % vncdisplay]
             ret += ['-k', 'en-us']
+            vnclisten = sxp.child_value(config, 'vnclisten')
+            if not(vnclisten):
+                vnclisten = 
xen.xend.XendRoot.instance().get_vnclisten_address()
+            if vnclisten:
+                ret += ['-vnclisten', vnclisten]
         return ret
 
     def createDeviceModel(self):
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xm/create.py
--- a/tools/python/xen/xm/create.py     Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xm/create.py     Sat Oct 14 13:28:45 2006 -0600
@@ -414,6 +414,10 @@ gopts.var('vncdisplay', val='',
 gopts.var('vncdisplay', val='',
           fn=set_value, default=None,
           use="""VNC display to use""")
+
+gopts.var('vnclisten', val='',
+          fn=set_value, default=None,
+          use="""Address for VNC server to listen on.""")
 
 gopts.var('vncunused', val='',
           fn=set_bool, default=1,
@@ -633,8 +637,9 @@ def configure_hvm(config_image, vals):
     """
     args = [ 'device_model', 'pae', 'vcpus', 'boot', 'fda', 'fdb',
              'localtime', 'serial', 'stdvga', 'isa', 'nographic', 'soundhw',
-             'vnc', 'vncdisplay', 'vncunused', 'vncconsole', 'sdl', 'display',
-             'acpi', 'apic', 'xauthority', 'usb', 'usbdevice' ]
+             'vnc', 'vncdisplay', 'vncunused', 'vncconsole', 'vnclisten',
+             'sdl', 'display', 'xauthority',
+             'acpi', 'apic', 'usb', 'usbdevice' ]
     for a in args:
         if (vals.__dict__[a]):
             config_image.append([a, vals.__dict__[a]])
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xm/main.py
--- a/tools/python/xen/xm/main.py       Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xm/main.py       Sat Oct 14 13:28:45 2006 -0600
@@ -290,6 +290,11 @@ all_commands = (domain_commands + host_c
 
 def cmdHelp(cmd):
     """Print help for a specific subcommand."""
+    
+    for fc in SUBCOMMAND_HELP.keys():
+        if fc[:len(cmd)] == cmd:
+            cmd = fc
+            break
     
     try:
         args, desc = SUBCOMMAND_HELP[cmd]
diff -r 5176c3ea3293 -r b725c9e51a7c tools/xenstore/xenstore_client.c
--- a/tools/xenstore/xenstore_client.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/xenstore/xenstore_client.c  Sat Oct 14 13:28:45 2006 -0600
@@ -267,12 +267,13 @@ main(int argc, char **argv)
 main(int argc, char **argv)
 {
     struct xs_handle *xsh;
-    xs_transaction_t xth;
+    xs_transaction_t xth = XBT_NULL;
     int ret = 0, socket = 0;
     int prefix = 0;
     int tidy = 0;
     int upto = 0;
     int recurse = 0;
+    int transaction;
 
     while (1) {
        int c, index = 0;
@@ -339,18 +340,28 @@ main(int argc, char **argv)
     }
 #endif
 
+#if defined(CLIENT_read)
+    transaction = (argc - optind) > 1;
+#elif defined(CLIENT_write)
+    transaction = (argc - optind) > 2;
+#else
+    transaction = 1;
+#endif
+
     xsh = socket ? xs_daemon_open() : xs_domain_open();
     if (xsh == NULL)
        err(1, socket ? "xs_daemon_open" : "xs_domain_open");
 
   again:
-    xth = xs_transaction_start(xsh);
-    if (xth == XBT_NULL)
-       errx(1, "couldn't start transaction");
+    if (transaction) {
+       xth = xs_transaction_start(xsh);
+       if (xth == XBT_NULL)
+           errx(1, "couldn't start transaction");
+    }
 
     ret = perform(optind, argc, argv, xsh, xth, prefix, tidy, upto, recurse);
 
-    if (!xs_transaction_end(xsh, xth, ret)) {
+    if (transaction && !xs_transaction_end(xsh, xth, ret)) {
        if (ret == 0 && errno == EAGAIN) {
            output_pos = 0;
            goto again;
diff -r 5176c3ea3293 -r b725c9e51a7c tools/xenstore/xenstored_transaction.c
--- a/tools/xenstore/xenstored_transaction.c    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/xenstore/xenstored_transaction.c    Sat Oct 14 13:28:45 2006 -0600
@@ -133,7 +133,7 @@ void do_transaction_start(struct connect
                return;
        }
 
-       if (conn->transaction_started > quota_max_transaction) {
+       if (conn->id && conn->transaction_started > quota_max_transaction) {
                send_error(conn, ENOSPC);
                return;
        }
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/Makefile
--- a/xen/arch/x86/Makefile     Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/Makefile     Sat Oct 14 13:28:45 2006 -0600
@@ -53,18 +53,18 @@ obj-$(crash_debug) += gdbstub.o
        $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/common/symbols-dummy.o
        $(LD) $(LDFLAGS) -T xen.lds -N \
            boot/$(TARGET_SUBARCH).o $(ALL_OBJS) \
-           $(BASEDIR)/common/symbols-dummy.o -o $@
-       $(NM) -n $@ | $(BASEDIR)/tools/symbols >$(BASEDIR)/xen-syms.S
-       $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/xen-syms.o
+           $(BASEDIR)/common/symbols-dummy.o -o $(@D)/.$(@F).0
+       $(NM) -n $(@D)/.$(@F).0 | $(BASEDIR)/tools/symbols >$(@D)/.$(@F).0.S
+       $(MAKE) -f $(BASEDIR)/Rules.mk $(@D)/.$(@F).0.o
        $(LD) $(LDFLAGS) -T xen.lds -N \
            boot/$(TARGET_SUBARCH).o $(ALL_OBJS) \
-           $(BASEDIR)/xen-syms.o -o $@
-       $(NM) -n $@ | $(BASEDIR)/tools/symbols >$(BASEDIR)/xen-syms.S
-       $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/xen-syms.o
+           $(@D)/.$(@F).0.o -o $(@D)/.$(@F).1
+       $(NM) -n $(@D)/.$(@F).1 | $(BASEDIR)/tools/symbols >$(@D)/.$(@F).1.S
+       $(MAKE) -f $(BASEDIR)/Rules.mk $(@D)/.$(@F).1.o
        $(LD) $(LDFLAGS) -T xen.lds -N \
            boot/$(TARGET_SUBARCH).o $(ALL_OBJS) \
-           $(BASEDIR)/xen-syms.o -o $@
-       rm -f $(BASEDIR)/xen-syms.S $(BASEDIR)/xen-syms.o
+           $(@D)/.$(@F).1.o -o $@
+       rm -f $(@D)/.$(@F).[0-9]*
 
 asm-offsets.s: $(TARGET_SUBARCH)/asm-offsets.c $(HDRS)
        $(CC) $(CFLAGS) -S -o $@ $<
@@ -78,3 +78,4 @@ boot/mkelf32: boot/mkelf32.c
 .PHONY: clean
 clean::
        rm -f asm-offsets.s xen.lds boot/*.o boot/*~ boot/core boot/mkelf32
+       rm -f $(BASEDIR)/.xen-syms.[0-9]*
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/domain_build.c
--- a/xen/arch/x86/domain_build.c       Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/domain_build.c       Sat Oct 14 13:28:45 2006 -0600
@@ -401,11 +401,11 @@ int construct_dom0(struct domain *d,
            _p(dsi.v_start), _p(v_end));
     printk(" ENTRY ADDRESS: %p\n", _p(dsi.v_kernentry));
 
-    if ( (v_end - dsi.v_start) > (nr_pages * PAGE_SIZE) )
+    if ( ((v_end - dsi.v_start)>>PAGE_SHIFT) > nr_pages )
     {
         printk("Initial guest OS requires too much space\n"
                "(%luMB is greater than %luMB limit)\n",
-               (v_end-dsi.v_start)>>20, (nr_pages<<PAGE_SHIFT)>>20);
+               (v_end-dsi.v_start)>>20, nr_pages>>(20-PAGE_SHIFT));
         return -ENOMEM;
     }
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/hvm/hvm.c
--- a/xen/arch/x86/hvm/hvm.c    Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/hvm/hvm.c    Sat Oct 14 13:28:45 2006 -0600
@@ -653,15 +653,15 @@ int hvm_bringup_ap(int vcpuid, int tramp
     if ( rc != 0 )
     {
         DPRINTK("AP %d bringup failed in boot_vcpu %x.\n", vcpuid, rc);
-        return rc;
+        goto out;
     }
 
     if ( test_and_clear_bit(_VCPUF_down, &d->vcpu[vcpuid]->vcpu_flags) )
         vcpu_wake(d->vcpu[vcpuid]);
     DPRINTK("AP %d bringup suceeded.\n", vcpuid);
 
+ out:
     xfree(ctxt);
-
     return rc;
 }
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/hvm/svm/intr.c
--- a/xen/arch/x86/hvm/svm/intr.c       Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/hvm/svm/intr.c       Sat Oct 14 13:28:45 2006 -0600
@@ -74,6 +74,7 @@ asmlinkage void svm_intr_assist(void)
     int intr_type = APIC_DM_EXTINT;
     int intr_vector = -1;
     int re_injecting = 0;
+    unsigned long rflags;
 
     ASSERT(vmcb);
 
@@ -86,6 +87,14 @@ asmlinkage void svm_intr_assist(void)
         re_injecting = 1;
     }
 
+    /* Guest's interrputs masked? */
+    rflags = vmcb->rflags;
+    if (irq_masked(rflags)) {
+        HVM_DBG_LOG(DBG_LEVEL_1, "Guest IRQs masked: rflags: %lx", rflags);
+        /* bail out, we won't be injecting an interrupt this time */
+        return;
+    }
+    
     /* Previous interrupt still pending? */
     if (vmcb->vintr.fields.irq) {
 //        printk("Re-injecting IRQ from Vintr\n");
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/hvm/svm/svm.c
--- a/xen/arch/x86/hvm/svm/svm.c        Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/hvm/svm/svm.c        Sat Oct 14 13:28:45 2006 -0600
@@ -840,7 +840,15 @@ int start_svm(void)
     
     if (!(test_bit(X86_FEATURE_SVME, &boot_cpu_data.x86_capability)))
         return 0;
-    
+
+    /* check whether SVM feature is disabled in BIOS */
+    rdmsr(MSR_K8_VM_CR, eax, edx);
+    if ( eax & K8_VMCR_SVME_DISABLE )
+    {
+        printk("AMD SVM Extension is disabled in BIOS.\n");
+        return 0;
+    }
+
     if (!(hsa[cpu] = alloc_host_save_area()))
         return 0;
     
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/hvm/vmx/vmx.c
--- a/xen/arch/x86/hvm/vmx/vmx.c        Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/hvm/vmx/vmx.c        Sat Oct 14 13:28:45 2006 -0600
@@ -226,21 +226,10 @@ static inline int long_mode_do_msr_read(
     case MSR_EFER:
         HVM_DBG_LOG(DBG_LEVEL_2, "EFER msr_content 0x%"PRIx64, msr_content);
         msr_content = msr->msr_items[VMX_INDEX_MSR_EFER];
-
-        /* the following code may be not needed */
-        if ( test_bit(VMX_CPU_STATE_LME_ENABLED, &v->arch.hvm_vmx.cpu_state) )
-            msr_content |= EFER_LME;
-        else
-            msr_content &= ~EFER_LME;
-
-        if ( VMX_LONG_GUEST(v) )
-            msr_content |= EFER_LMA;
-        else
-            msr_content &= ~EFER_LMA;
         break;
 
     case MSR_FS_BASE:
-        if ( !(VMX_LONG_GUEST(v)) )
+        if ( !(vmx_long_mode_enabled(v)) )
             /* XXX should it be GP fault */
             domain_crash_synchronous();
 
@@ -248,7 +237,7 @@ static inline int long_mode_do_msr_read(
         break;
 
     case MSR_GS_BASE:
-        if ( !(VMX_LONG_GUEST(v)) )
+        if ( !(vmx_long_mode_enabled(v)) )
             domain_crash_synchronous();
 
         __vmread(GUEST_GS_BASE, &msr_content);
@@ -296,21 +285,25 @@ static inline int long_mode_do_msr_write
             return 0;
         }
 
-        /* LME: 0 -> 1 */
-        if ( msr_content & EFER_LME &&
-             !test_bit(VMX_CPU_STATE_LME_ENABLED, &v->arch.hvm_vmx.cpu_state) )
-        {
-            if ( vmx_paging_enabled(v) ||
-                 !test_bit(VMX_CPU_STATE_PAE_ENABLED,
-                           &v->arch.hvm_vmx.cpu_state) )
+        if ( (msr_content & EFER_LME)
+             &&  !(msr->msr_items[VMX_INDEX_MSR_EFER] & EFER_LME) )
+        {
+            if ( unlikely(vmx_paging_enabled(v)) )
             {
-                printk("Trying to set LME bit when "
-                       "in paging mode or PAE bit is not set\n");
+                printk("Trying to set EFER.LME with paging enabled\n");
                 vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
                 return 0;
             }
-
-            set_bit(VMX_CPU_STATE_LME_ENABLED, &v->arch.hvm_vmx.cpu_state);
+        }
+        else if ( !(msr_content & EFER_LME)
+                  && (msr->msr_items[VMX_INDEX_MSR_EFER] & EFER_LME) )
+        {
+            if ( unlikely(vmx_paging_enabled(v)) )
+            {
+                printk("Trying to clear EFER.LME with paging enabled\n");
+                vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
+                return 0;
+            }
         }
 
         msr->msr_items[VMX_INDEX_MSR_EFER] = msr_content;
@@ -318,7 +311,7 @@ static inline int long_mode_do_msr_write
 
     case MSR_FS_BASE:
     case MSR_GS_BASE:
-        if ( !(VMX_LONG_GUEST(v)) )
+        if ( !(vmx_long_mode_enabled(v)) )
             domain_crash_synchronous();
 
         if ( !IS_CANO_ADDRESS(msr_content) )
@@ -336,7 +329,7 @@ static inline int long_mode_do_msr_write
         break;
 
     case MSR_SHADOW_GS_BASE:
-        if ( !(VMX_LONG_GUEST(v)) )
+        if ( !(vmx_long_mode_enabled(v)) )
             domain_crash_synchronous();
 
         v->arch.hvm_vmx.msr_content.shadow_gs = msr_content;
@@ -1257,7 +1250,7 @@ static int vmx_world_save(struct vcpu *v
 
 static int vmx_world_restore(struct vcpu *v, struct vmx_assist_context *c)
 {
-    unsigned long mfn, old_cr4, old_base_mfn;
+    unsigned long mfn, old_base_mfn;
     int error = 0;
 
     error |= __vmwrite(GUEST_RIP, c->eip);
@@ -1307,14 +1300,11 @@ static int vmx_world_restore(struct vcpu
 
  skip_cr3:
 
-    shadow_update_paging_modes(v);
     if (!vmx_paging_enabled(v))
         HVM_DBG_LOG(DBG_LEVEL_VMMU, "switching to vmxassist. use phys table");
     else
         HVM_DBG_LOG(DBG_LEVEL_VMMU, "Update CR3 value = %x", c->cr3);
-    __vmwrite(GUEST_CR3, v->arch.hvm_vcpu.hw_cr3);
-
-    error |= __vmread(CR4_READ_SHADOW, &old_cr4);
+
     error |= __vmwrite(GUEST_CR4, (c->cr4 | VMX_CR4_HOST_MASK));
     error |= __vmwrite(CR4_READ_SHADOW, c->cr4);
 
@@ -1363,6 +1353,9 @@ static int vmx_world_restore(struct vcpu
     error |= __vmwrite(GUEST_LDTR_LIMIT, c->ldtr_limit);
     error |= __vmwrite(GUEST_LDTR_BASE, c->ldtr_base);
     error |= __vmwrite(GUEST_LDTR_AR_BYTES, c->ldtr_arbytes.bytes);
+
+    shadow_update_paging_modes(v);
+    __vmwrite(GUEST_CR3, v->arch.hvm_vcpu.hw_cr3);
 
     return !error;
 }
@@ -1408,6 +1401,7 @@ static int vmx_assist(struct vcpu *v, in
                 goto error;
             if (!vmx_world_restore(v, &c))
                 goto error;
+            v->arch.hvm_vmx.vmxassist_enabled = 1;            
             return 1;
         }
         break;
@@ -1425,6 +1419,7 @@ static int vmx_assist(struct vcpu *v, in
                 goto error;
             if (!vmx_world_restore(v, &c))
                 goto error;
+            v->arch.hvm_vmx.vmxassist_enabled = 0;
             return 1;
         }
         break;
@@ -1480,26 +1475,23 @@ static int vmx_set_cr0(unsigned long val
         }
 
 #if defined(__x86_64__)
-        if ( test_bit(VMX_CPU_STATE_LME_ENABLED,
-                      &v->arch.hvm_vmx.cpu_state) &&
-             !test_bit(VMX_CPU_STATE_PAE_ENABLED,
-                       &v->arch.hvm_vmx.cpu_state) )
-        {
-            HVM_DBG_LOG(DBG_LEVEL_1, "Enable paging before PAE enabled\n");
-            vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
-        }
-
-        if ( test_bit(VMX_CPU_STATE_LME_ENABLED,
-                     &v->arch.hvm_vmx.cpu_state) )
-        {
-            /* Here the PAE is should be opened */
-            HVM_DBG_LOG(DBG_LEVEL_1, "Enable long mode\n");
-            set_bit(VMX_CPU_STATE_LMA_ENABLED,
-                    &v->arch.hvm_vmx.cpu_state);
-
-            __vmread(VM_ENTRY_CONTROLS, &vm_entry_value);
-            vm_entry_value |= VM_ENTRY_IA32E_MODE;
-            __vmwrite(VM_ENTRY_CONTROLS, vm_entry_value);
+        if ( vmx_lme_is_set(v) )
+        {
+            if ( !(v->arch.hvm_vmx.cpu_shadow_cr4 & X86_CR4_PAE) )
+            {
+                HVM_DBG_LOG(DBG_LEVEL_1, "Guest enabled paging "
+                            "with EFER.LME set but not CR4.PAE\n");
+                vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
+            }
+            else 
+            {
+                HVM_DBG_LOG(DBG_LEVEL_1, "Enabling long mode\n");
+                v->arch.hvm_vmx.msr_content.msr_items[VMX_INDEX_MSR_EFER]
+                    |= EFER_LMA;
+                __vmread(VM_ENTRY_CONTROLS, &vm_entry_value);
+                vm_entry_value |= VM_ENTRY_IA32E_MODE;
+                __vmwrite(VM_ENTRY_CONTROLS, vm_entry_value);
+            }
         }
 #endif
 
@@ -1546,11 +1538,10 @@ static int vmx_set_cr0(unsigned long val
              * Disable paging here.
              * Same to PE == 1 && PG == 0
              */
-            if ( test_bit(VMX_CPU_STATE_LMA_ENABLED,
-                          &v->arch.hvm_vmx.cpu_state) )
+            if ( vmx_long_mode_enabled(v) )
             {
-                clear_bit(VMX_CPU_STATE_LMA_ENABLED,
-                          &v->arch.hvm_vmx.cpu_state);
+                v->arch.hvm_vmx.msr_content.msr_items[VMX_INDEX_MSR_EFER]
+                    &= ~EFER_LMA;
                 __vmread(VM_ENTRY_CONTROLS, &vm_entry_value);
                 vm_entry_value &= ~VM_ENTRY_IA32E_MODE;
                 __vmwrite(VM_ENTRY_CONTROLS, vm_entry_value);
@@ -1559,22 +1550,19 @@ static int vmx_set_cr0(unsigned long val
 
         if ( vmx_assist(v, VMX_ASSIST_INVOKE) )
         {
-            set_bit(VMX_CPU_STATE_ASSIST_ENABLED, &v->arch.hvm_vmx.cpu_state);
             __vmread(GUEST_RIP, &eip);
             HVM_DBG_LOG(DBG_LEVEL_1,
                         "Transfering control to vmxassist %%eip 0x%lx\n", eip);
             return 0; /* do not update eip! */
         }
-    } else if ( test_bit(VMX_CPU_STATE_ASSIST_ENABLED,
-                         &v->arch.hvm_vmx.cpu_state) )
+    }
+    else if ( v->arch.hvm_vmx.vmxassist_enabled )
     {
         __vmread(GUEST_RIP, &eip);
         HVM_DBG_LOG(DBG_LEVEL_1,
                     "Enabling CR0.PE at %%eip 0x%lx\n", eip);
         if ( vmx_assist(v, VMX_ASSIST_RESTORE) )
         {
-            clear_bit(VMX_CPU_STATE_ASSIST_ENABLED,
-                      &v->arch.hvm_vmx.cpu_state);
             __vmread(GUEST_RIP, &eip);
             HVM_DBG_LOG(DBG_LEVEL_1,
                         "Restoring to %%eip 0x%lx\n", eip);
@@ -1583,8 +1571,8 @@ static int vmx_set_cr0(unsigned long val
     }
     else if ( (value & (X86_CR0_PE | X86_CR0_PG)) == X86_CR0_PE )
     {
+        shadow_update_paging_modes(v);
         __vmwrite(GUEST_CR3, v->arch.hvm_vcpu.hw_cr3);
-        shadow_update_paging_modes(v);
     }
 
     return 1;
@@ -1705,8 +1693,6 @@ static int mov_to_cr(int gp, int cr, str
 
         if ( value & X86_CR4_PAE && !(old_cr & X86_CR4_PAE) )
         {
-            set_bit(VMX_CPU_STATE_PAE_ENABLED, &v->arch.hvm_vmx.cpu_state);
-
             if ( vmx_pgbit_test(v) )
             {
                 /* The guest is a 32-bit PAE guest. */
@@ -1745,14 +1731,14 @@ static int mov_to_cr(int gp, int cr, str
 #endif
             }
         }
-        else if ( value & X86_CR4_PAE )
-            set_bit(VMX_CPU_STATE_PAE_ENABLED, &v->arch.hvm_vmx.cpu_state);
-        else
-        {
-            if ( test_bit(VMX_CPU_STATE_LMA_ENABLED, 
&v->arch.hvm_vmx.cpu_state) )
+        else if ( !(value & X86_CR4_PAE) )
+        {
+            if ( unlikely(vmx_long_mode_enabled(v)) )
+            {
+                HVM_DBG_LOG(DBG_LEVEL_1, "Guest cleared CR4.PAE while "
+                            "EFER.LMA is set\n");
                 vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
-
-            clear_bit(VMX_CPU_STATE_PAE_ENABLED, &v->arch.hvm_vmx.cpu_state);
+            }
         }
 
         __vmwrite(GUEST_CR4, value| VMX_CR4_HOST_MASK);
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/microcode.c
--- a/xen/arch/x86/microcode.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/microcode.c  Sat Oct 14 13:28:45 2006 -0600
@@ -455,7 +455,7 @@ out:
        return error;
 }
 
-int microcode_update(void *buf, unsigned long len)
+int microcode_update(XEN_GUEST_HANDLE(void) buf, unsigned long len)
 {
        int ret;
 
@@ -464,10 +464,15 @@ int microcode_update(void *buf, unsigned
                return -EINVAL;
        }
 
+       if (len != (typeof(user_buffer_size))len) {
+               printk(KERN_ERR "microcode: too much data\n");
+               return -E2BIG;
+       }
+
        mutex_lock(&microcode_mutex);
 
-       user_buffer = (void __user *) buf;
-       user_buffer_size = (int) len;
+       user_buffer = buf.p;
+       user_buffer_size = len;
 
        ret = do_microcode_update();
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/mm/shadow/multi.c
--- a/xen/arch/x86/mm/shadow/multi.c    Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/mm/shadow/multi.c    Sat Oct 14 13:28:45 2006 -0600
@@ -1375,80 +1375,6 @@ static int shadow_set_l1e(struct vcpu *v
 
 
 /**************************************************************************/
-/* These functions take a vcpu and a virtual address, and return a pointer
- * to the appropriate level N entry from the shadow tables.  
- * If the necessary tables are not present in the shadow, they return NULL. */
-
-/* N.B. The use of GUEST_PAGING_LEVELS here is correct.  If the shadow has
- * more levels than the guest, the upper levels are always fixed and do not 
- * reflect any information from the guest, so we do not use these functions 
- * to access them. */
-
-#if GUEST_PAGING_LEVELS >= 4
-static shadow_l4e_t *
-shadow_get_l4e(struct vcpu *v, unsigned long va)
-{
-    /* Reading the top level table is always valid. */
-    return sh_linear_l4_table(v) + shadow_l4_linear_offset(va);
-}
-#endif /* GUEST_PAGING_LEVELS >= 4 */
-
-
-#if GUEST_PAGING_LEVELS >= 3
-static shadow_l3e_t *
-shadow_get_l3e(struct vcpu *v, unsigned long va)
-{
-#if GUEST_PAGING_LEVELS >= 4 /* 64bit... */
-    /* Get the l4 */
-    shadow_l4e_t *sl4e = shadow_get_l4e(v, va);
-    ASSERT(sl4e != NULL);
-    if ( !(shadow_l4e_get_flags(*sl4e) & _PAGE_PRESENT) )
-        return NULL;
-    ASSERT(valid_mfn(shadow_l4e_get_mfn(*sl4e)));
-    /* l4 was present; OK to get the l3 */
-    return sh_linear_l3_table(v) + shadow_l3_linear_offset(va);
-#else /* PAE... */
-    /* Top level is always mapped */
-    ASSERT(v->arch.shadow_vtable);
-    return ((shadow_l3e_t *)v->arch.shadow_vtable) + 
shadow_l3_linear_offset(va);
-#endif 
-}
-#endif /* GUEST_PAGING_LEVELS >= 3 */
-
-
-static shadow_l2e_t *
-shadow_get_l2e(struct vcpu *v, unsigned long va)
-{
-#if GUEST_PAGING_LEVELS >= 3  /* 64bit/PAE... */
-    /* Get the l3 */
-    shadow_l3e_t *sl3e = shadow_get_l3e(v, va);
-    if ( sl3e == NULL || !(shadow_l3e_get_flags(*sl3e) & _PAGE_PRESENT) )
-        return NULL;
-    ASSERT(valid_mfn(shadow_l3e_get_mfn(*sl3e)));
-    /* l3 was present; OK to get the l2 */
-#endif
-    return sh_linear_l2_table(v) + shadow_l2_linear_offset(va);
-}
-
-
-#if 0 // avoid the compiler warning for now...
-
-static shadow_l1e_t *
-shadow_get_l1e(struct vcpu *v, unsigned long va)
-{
-    /* Get the l2 */
-    shadow_l2e_t *sl2e = shadow_get_l2e(v, va);
-    if ( sl2e == NULL || !(shadow_l2e_get_flags(*sl2e) & _PAGE_PRESENT) )
-        return NULL;
-    ASSERT(valid_mfn(shadow_l2e_get_mfn(*sl2e)));
-    /* l2 was present; OK to get the l1 */
-    return sh_linear_l1_table(v) + shadow_l1_linear_offset(va);
-}
-
-#endif
-
-
-/**************************************************************************/
 /* Macros to walk pagetables.  These take the shadow of a pagetable and 
  * walk every "interesting" entry.  That is, they don't touch Xen mappings, 
  * and for 32-bit l2s shadowed onto PAE or 64-bit, they only touch every 
@@ -2050,6 +1976,12 @@ sh_make_monitor_table(struct vcpu *v)
  * they are needed.  The "demand" argument is non-zero when handling
  * a demand fault (so we know what to do about accessed bits &c).
  * If the necessary tables are not present in the guest, they return NULL. */
+
+/* N.B. The use of GUEST_PAGING_LEVELS here is correct.  If the shadow has
+ * more levels than the guest, the upper levels are always fixed and do not 
+ * reflect any information from the guest, so we do not use these functions 
+ * to access them. */
+
 #if GUEST_PAGING_LEVELS >= 4
 static shadow_l4e_t * shadow_get_and_create_l4e(struct vcpu *v, 
                                                 walk_t *gw, 
@@ -2324,11 +2256,11 @@ static void sh_destroy_l3_subshadow(stru
 /* Tear down just a single 4-entry l3 on a 2-page l3 shadow. */
 {
     int i;
+    mfn_t sl3mfn = _mfn(maddr_from_mapped_domain_page(sl3e) >> PAGE_SHIFT);
     ASSERT((unsigned long)sl3e % (4 * sizeof (shadow_l3e_t)) == 0); 
     for ( i = 0; i < GUEST_L3_PAGETABLE_ENTRIES; i++ ) 
         if ( shadow_l3e_get_flags(sl3e[i]) & _PAGE_PRESENT ) 
-            sh_put_ref(v, shadow_l3e_get_mfn(sl3e[i]),
-                        maddr_from_mapped_domain_page(sl3e));
+            shadow_set_l3e(v, &sl3e[i], shadow_l3e_empty(), sl3mfn);
 }
 #endif
 
@@ -3223,26 +3155,62 @@ sh_invlpg(struct vcpu *v, unsigned long 
  * instruction should be issued on the hardware, or 0 if it's safe not
  * to do so. */
 {
-    shadow_l2e_t *ptr_sl2e = shadow_get_l2e(v, va);
-
-    // XXX -- might be a good thing to prefetch the va into the shadow
-
-    // no need to flush anything if there's no SL2...
-    //
-    if ( !ptr_sl2e )
+    shadow_l2e_t sl2e;
+    
+    perfc_incrc(shadow_invlpg);
+
+    /* First check that we can safely read the shadow l2e.  SMP/PAE linux can
+     * run as high as 6% of invlpg calls where we haven't shadowed the l2 
+     * yet. */
+#if SHADOW_PAGING_LEVELS == 4
+    {
+        shadow_l3e_t sl3e;
+        if ( !(shadow_l4e_get_flags(
+                   sh_linear_l4_table(v)[shadow_l4_linear_offset(va)])
+               & _PAGE_PRESENT) )
+            return 0;
+        /* This must still be a copy-from-user because we don't have the
+         * shadow lock, and the higher-level shadows might disappear
+         * under our feet. */
+        if ( __copy_from_user(&sl3e, (sh_linear_l3_table(v) 
+                                      + shadow_l3_linear_offset(va)),
+                              sizeof (sl3e)) != 0 )
+        {
+            perfc_incrc(shadow_invlpg_fault);
+            return 0;
+        }
+        if ( (!shadow_l3e_get_flags(sl3e) & _PAGE_PRESENT) )
+            return 0;
+    }
+#elif SHADOW_PAGING_LEVELS == 3
+    if ( !(shadow_l3e_get_flags(
+          ((shadow_l3e_t *)v->arch.shadow_vtable)[shadow_l3_linear_offset(va)])
+           & _PAGE_PRESENT) )
+        // no need to flush anything if there's no SL2...
         return 0;
+#endif
+
+    /* This must still be a copy-from-user because we don't have the shadow
+     * lock, and the higher-level shadows might disappear under our feet. */
+    if ( __copy_from_user(&sl2e, 
+                          sh_linear_l2_table(v) + shadow_l2_linear_offset(va),
+                          sizeof (sl2e)) != 0 )
+    {
+        perfc_incrc(shadow_invlpg_fault);
+        return 0;
+    }
 
     // If there's nothing shadowed for this particular sl2e, then
     // there is no need to do an invlpg, either...
     //
-    if ( !(shadow_l2e_get_flags(*ptr_sl2e) & _PAGE_PRESENT) )
+    if ( !(shadow_l2e_get_flags(sl2e) & _PAGE_PRESENT) )
         return 0;
 
     // Check to see if the SL2 is a splintered superpage...
     // If so, then we'll need to flush the entire TLB (because that's
     // easier than invalidating all of the individual 4K pages).
     //
-    if ( (mfn_to_page(shadow_l2e_get_mfn(*ptr_sl2e))->count_info &
+    if ( (mfn_to_page(shadow_l2e_get_mfn(sl2e))->count_info &
           PGC_SH_type_mask) == PGC_SH_fl1_shadow )
     {
         local_flush_tlb();
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/platform_hypercall.c
--- a/xen/arch/x86/platform_hypercall.c Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/platform_hypercall.c Sat Oct 14 13:28:45 2006 -0600
@@ -58,12 +58,13 @@ long do_platform_op(XEN_GUEST_HANDLE(xen
             op->u.add_memtype.nr_mfns,
             op->u.add_memtype.type,
             1);
-        if ( ret > 0 )
+        if ( ret >= 0 )
         {
             op->u.add_memtype.handle = 0;
             op->u.add_memtype.reg    = ret;
-            (void)copy_to_guest(u_xenpf_op, op, 1);
-            ret = 0;
+            ret = copy_to_guest(u_xenpf_op, op, 1) ? -EFAULT : 0;
+            if ( ret != 0 )
+                mtrr_del_page(ret, 0, 0);
         }
     }
     break;
@@ -75,7 +76,7 @@ long do_platform_op(XEN_GUEST_HANDLE(xen
             && (int)op->u.del_memtype.reg >= 0)
         {
             ret = mtrr_del_page(op->u.del_memtype.reg, 0, 0);
-            if (ret > 0)
+            if ( ret > 0 )
                 ret = 0;
         }
         else
@@ -96,16 +97,15 @@ long do_platform_op(XEN_GUEST_HANDLE(xen
             op->u.read_memtype.mfn     = mfn;
             op->u.read_memtype.nr_mfns = nr_mfns;
             op->u.read_memtype.type    = type;
-            (void)copy_to_guest(u_xenpf_op, op, 1);
-            ret = 0;
+            ret = copy_to_guest(u_xenpf_op, op, 1) ? -EFAULT : 0;
         }
     }
     break;
 
     case XENPF_microcode_update:
     {
-        extern int microcode_update(void *buf, unsigned long len);
-        ret = microcode_update(op->u.microcode.data.p,
+        extern int microcode_update(XEN_GUEST_HANDLE(void), unsigned long len);
+        ret = microcode_update(op->u.microcode.data,
                                op->u.microcode.length);
     }
     break;
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/x86_32/asm-offsets.c
--- a/xen/arch/x86/x86_32/asm-offsets.c Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/x86_32/asm-offsets.c Sat Oct 14 13:28:45 2006 -0600
@@ -118,7 +118,6 @@ void __dummy__(void)
     OFFSET(MULTICALL_arg3, struct multicall_entry, args[3]);
     OFFSET(MULTICALL_arg4, struct multicall_entry, args[4]);
     OFFSET(MULTICALL_arg5, struct multicall_entry, args[5]);
-    OFFSET(MULTICALL_arg6, struct multicall_entry, args[6]);
     OFFSET(MULTICALL_result, struct multicall_entry, result);
     BLANK();
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/x86_64/asm-offsets.c
--- a/xen/arch/x86/x86_64/asm-offsets.c Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/x86_64/asm-offsets.c Sat Oct 14 13:28:45 2006 -0600
@@ -112,7 +112,6 @@ void __dummy__(void)
     OFFSET(MULTICALL_arg3, struct multicall_entry, args[3]);
     OFFSET(MULTICALL_arg4, struct multicall_entry, args[4]);
     OFFSET(MULTICALL_arg5, struct multicall_entry, args[5]);
-    OFFSET(MULTICALL_arg6, struct multicall_entry, args[6]);
     OFFSET(MULTICALL_result, struct multicall_entry, result);
     BLANK();
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/common/elf.c
--- a/xen/common/elf.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/common/elf.c  Sat Oct 14 13:28:45 2006 -0600
@@ -304,7 +304,7 @@ int parseelfimage(struct domain_setup_in
         if ( p != NULL && strncmp(p, "yes", 3) == 0 )
         {
             dsi->pae_kernel = PAEKERN_yes;
-            if ( !strncmp(p+4, "[extended-cr3]", 14) )
+            if ( !strncmp(p+3, "[extended-cr3]", 14) )
                 dsi->pae_kernel = PAEKERN_extended_cr3;
         }
     }
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/hvm/vmx/vmcs.h
--- a/xen/include/asm-x86/hvm/vmx/vmcs.h        Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/hvm/vmx/vmcs.h        Sat Oct 14 13:28:45 2006 -0600
@@ -28,19 +28,6 @@ extern void vmcs_dump_vcpu(void);
 extern void vmcs_dump_vcpu(void);
 extern void vmx_init_vmcs_config(void);
 extern void setup_vmcs_dump(void);
-
-enum {
-    VMX_CPU_STATE_PAE_ENABLED=0,
-    VMX_CPU_STATE_LME_ENABLED,
-    VMX_CPU_STATE_LMA_ENABLED,
-    VMX_CPU_STATE_ASSIST_ENABLED,
-};
-
-#define VMX_LONG_GUEST(ed)    \
-  (test_bit(VMX_CPU_STATE_LMA_ENABLED, &ed->arch.hvm_vmx.cpu_state))
-
-#define VMX_PAE_GUEST(ed)       \
-  (test_bit(VMX_CPU_STATE_PAE_ENABLED, &ed->arch.hvm_vmx.cpu_state))
 
 struct vmcs_struct {
     u32 vmcs_revision_id;
@@ -93,10 +80,10 @@ struct arch_vmx_struct {
     unsigned long        cpu_shadow_cr4; /* copy of guest read shadow CR4 */
     unsigned long        cpu_cr2; /* save CR2 */
     unsigned long        cpu_cr3;
-    unsigned long        cpu_state;
     unsigned long        cpu_based_exec_control;
     struct vmx_msr_state msr_content;
     void                *io_bitmap_a, *io_bitmap_b;
+    unsigned long        vmxassist_enabled:1; 
 };
 
 #define vmx_schedule_tail(next)         \
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/hvm/vmx/vmx.h
--- a/xen/include/asm-x86/hvm/vmx/vmx.h Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/hvm/vmx/vmx.h Sat Oct 14 13:28:45 2006 -0600
@@ -335,26 +335,30 @@ static inline int __vmxon (u64 addr)
     return rc;
 }
 
-/* Works only for vcpu == current */
 static inline int vmx_paging_enabled(struct vcpu *v)
 {
     unsigned long cr0;
-
     __vmread_vcpu(v, CR0_READ_SHADOW, &cr0);
-    return (cr0 & X86_CR0_PE) && (cr0 & X86_CR0_PG);
-}
-
-/* Works only for vcpu == current */
+    return ((cr0 & (X86_CR0_PE|X86_CR0_PG)) == (X86_CR0_PE|X86_CR0_PG));
+}
+
+static inline int vmx_pae_enabled(struct vcpu *v)
+{
+    unsigned long cr4;
+    __vmread_vcpu(v, CR4_READ_SHADOW, &cr4);
+    return (vmx_paging_enabled(v) && (cr4 & X86_CR4_PAE));
+}
+
 static inline int vmx_long_mode_enabled(struct vcpu *v)
 {
-    ASSERT(v == current);
-    return VMX_LONG_GUEST(current);
-}
-
-static inline int vmx_pae_enabled(struct vcpu *v)
-{
-    ASSERT(v == current);
-    return VMX_PAE_GUEST(current);
+    u64 efer = v->arch.hvm_vmx.msr_content.msr_items[VMX_INDEX_MSR_EFER];
+    return efer & EFER_LMA;
+}
+
+static inline int vmx_lme_is_set(struct vcpu *v)
+{
+    u64 efer = v->arch.hvm_vmx.msr_content.msr_items[VMX_INDEX_MSR_EFER];
+    return efer & EFER_LME;
 }
 
 /* Works only for vcpu == current */
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/msr.h
--- a/xen/include/asm-x86/msr.h Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/msr.h Sat Oct 14 13:28:45 2006 -0600
@@ -302,8 +302,14 @@ static inline void wrmsrl(unsigned int m
 
 #define MSR_K8_TOP_MEM1                        0xC001001A
 #define MSR_K8_TOP_MEM2                        0xC001001D
+#define MSR_K8_SYSCFG                  0xC0010010
+#define MSR_K8_HWCR                    0xC0010015
+#define MSR_K8_VM_CR                   0xC0010114
 #define MSR_K8_VM_HSAVE_PA             0xC0010117
-#define MSR_K8_SYSCFG                  0xC0000010      
+
+/* MSR_K8_VM_CR bits: */
+#define _K8_VMCR_SVME_DISABLE          4
+#define K8_VMCR_SVME_DISABLE           (1 << _K8_VMCR_SVME_DISABLE)
 
 /* Centaur-Hauls/IDT defined MSRs. */
 #define MSR_IDT_FCR1                   0x107
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/multicall.h
--- a/xen/include/asm-x86/multicall.h   Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/multicall.h   Sat Oct 14 13:28:45 2006 -0600
@@ -16,7 +16,7 @@
             "    movq  "STR(MULTICALL_op)"(%0),%%rax; "      \
             "    cmpq  $("STR(NR_hypercalls)"),%%rax; "      \
             "    jae   2f; "                                 \
-            "    leaq  "STR(hypercall_table)"(%%rip),%%rdi; "\
+            "    leaq  hypercall_table(%%rip),%%rdi; "       \
             "    leaq  (%%rdi,%%rax,8),%%rax; "              \
             "    movq  "STR(MULTICALL_arg0)"(%0),%%rdi; "    \
             "    movq  "STR(MULTICALL_arg1)"(%0),%%rsi; "    \
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/perfc_defn.h
--- a/xen/include/asm-x86/perfc_defn.h  Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/perfc_defn.h  Sat Oct 14 13:28:45 2006 -0600
@@ -81,8 +81,8 @@ PERFCOUNTER_CPU(shadow_unshadow_bf,    "
 PERFCOUNTER_CPU(shadow_unshadow_bf,    "shadow unshadow brute-force")
 PERFCOUNTER_CPU(shadow_get_page_fail,  "shadow_get_page_from_l1e failed")
 PERFCOUNTER_CPU(shadow_guest_walk,     "shadow walks guest tables")
-PERFCOUNTER_CPU(shadow_walk_cache_hit, "shadow walk-cache hits")
-PERFCOUNTER_CPU(shadow_walk_cache_miss, "shadow walk-cache misses")
+PERFCOUNTER_CPU(shadow_invlpg,         "shadow emulates invlpg")
+PERFCOUNTER_CPU(shadow_invlpg_fault,   "shadow invlpg faults")
 
 
 /*#endif*/ /* __XEN_PERFC_DEFN_H__ */

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog